# Authentication library is on a recent release

- **Pattern:** `ab-002219` (`saas-authentication.social-auth.auth-library-version`)
- **Severity:** info
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-002219
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-002219)

## Why it matters

Authentication libraries receive security patches — CVEs in `next-auth`, `@supabase/supabase-js`, and similar packages have historically enabled token forgery, session bypass, and privilege escalation. CWE-1395 (Dependency on Vulnerable Third-Party Component) and OWASP A06 (Vulnerable and Outdated Components) directly cover this. SLSA L2 supply-chain provenance requires component currency verification. A library that is multiple major versions behind may lack patches for known exploitable vulnerabilities and lose access to security advisory channels entirely.

## Severity rationale

Info because version lag does not immediately indicate exploitation, but outdated auth libraries may contain known, publicly documented vulnerabilities with available exploits.

## Remediation

Check installed versions against latest stable releases and scan for known advisories:

```bash
# Check current vs. latest for common auth libraries
npm outdated next-auth @clerk/nextjs @supabase/supabase-js lucia @auth0/nextjs-auth0 2>/dev/null

# Check for known security advisories
npm audit --production 2>/dev/null | grep -i auth
```

Enable Dependabot or Renovate via `.github/dependabot.yml` for automated update PRs. Pin auth library versions in `package.json` to a specific minor version and use the PR-based update workflow to review changelogs before merging. Do not auto-merge major version bumps for auth libraries — review the changelog for breaking changes in session handling.

## Detection

- **ID:** `auth-library-version`
- **Severity:** `info`
- **What to look for:** Identify the primary authentication library from `package.json`. Check the installed version against the latest stable release. Libraries to check: next-auth/authjs, @clerk/nextjs, @supabase/supabase-js, lucia, better-auth, firebase, @auth0/nextjs-auth0. A version within 2 major versions of current is acceptable. Check if any known security advisories apply to the installed version. Count every authentication-related dependency and enumerate each with its current version and latest available version.
- **Pass criteria:** The auth library is within 2 major versions of the current stable release and has no known critical security advisories. At least 1 implementation must be confirmed.
- **Fail criteria:** The auth library is more than 2 major versions behind, or has a known critical security advisory for the installed version.
- **Skip (N/A) when:** No recognized auth library found. Signal: custom auth implementation with no third-party auth library.
- **Detail on fail:** `"next-auth v4.x installed — v5 (AuthJS) is the current major version. Check for any security advisories affecting v4"` or `"@supabase/supabase-js is 3 minor versions behind current — check changelog for security patches"`.
- **Remediation:** Auth libraries receive security patches — staying reasonably current ensures you benefit from fixes. Check the library's changelog and security advisories to determine if updating is urgent:

  ```bash
  # Check current vs. latest auth library versions
  npm outdated next-auth @clerk/nextjs @supabase/supabase-js lucia @auth0/nextjs-auth0 2>/dev/null
  # Check for known advisories
  npm audit --production 2>/dev/null | grep -i auth
  ```

  Pin versions in `package.json` and configure Dependabot or Renovate in `.github/` for automated update PRs.

## External references

- cwe CWE-1395
- owasp A06
- slsa L2

Taxons: supply-chain

HTML version: https://auditbuffet.com/patterns/ab-002219