GitHub OAuth provider no longer works. Was there some recent change by GitHub?

[RadStr]

Provider type

GitHub

Environment

  System:
    OS: Windows 10 10.0.19045
    CPU: (8) x64 Intel(R) Xeon(R) CPU E31245 @ 3.30GHz
    Memory: 4.06 GB / 15.96 GB
  Binaries:
    Node: 22.17.0 - C:\Program Files\nodejs\node.EXE
    Yarn: 1.22.22 - C:\Users\me\AppData\Roaming\npm\yarn.CMD
    npm: 10.9.2 - C:\Program Files\nodejs\npm.CMD
    bun: 1.2.18 - C:\Users\me\AppData\Roaming\npm\bun.CMD
  Browsers:
    Edge: Chromium (140.0.3485.54)
    Firefox: 149.0.2 - C:\Program Files\Mozilla Firefox\firefox.exe
    Firefox Developer Edition: 150.0 - C:\Program Files\Firefox Developer Edition\firefox.exe
    Internet Explorer: 11.0.19041.5794

Reproduction URL

https://github.com/dataspecer/dataspecer/tree/git-integration

Describe the issue

The issue is that when I try to sign-in using GitHub I get an server error seen below. Both when using my application and the official deployed example. I am 100% sure that my application worked a month ago and almost 100% sure that it did work 4 days ago. I also tried going back to older commits with the same result. Therefore, the issue should not be caused by me.

The sign-in results in the following image:

When running locally with debug option on I get the following error:

[auth][debug]: callback route error details {
  "method": "GET",
  "query": {
    "code": "xxxxxxxxxxxxxe0b2b",
    "iss": "https://github.com/login/oauth"
  }
}
[auth][error] CallbackRouteError: Read more at https://errors.authjs.dev#callbackrouteerror
[auth][cause]: OperationProcessingError: unexpected "iss" (issuer) response parameter value
    at OPE (C:\Users\me\my-oauth\node_modules\oauth4webapi\src\index.ts:1044:10)
    at Module.validateAuthResponse (C:\Users\me\my-oauth\node_modules\oauth4webapi\src\index.ts:5586:11)
    at handleOAuth (file:///C:/Users/me/my-oauth/node_modules/@auth/core/lib/actions/callback/oauth/callback.js:93:29)
    at async Module.callback (file:///C:/Users/me/my-oauth/node_modules/@auth/core/lib/actions/callback/index.js:37:41)
    at async AuthInternal (file:///C:/Users/me/my-oauth/node_modules/@auth/core/lib/index.js:29:24)
    at async Auth (file:///C:/Users/me/my-oauth/node_modules/@auth/core/index.js:111:34)
    at async file:///C:/Users/me/my-oauth/node_modules/@auth/express/index.js:151:45
[auth][details]: {
  "expected": "https://authjs.dev",
  "parameters": {},
  "provider": "github"
}

How to reproduce

Try signing in to the example URL using GitHub.

Expected behavior

I should be signed in with no issues. Any quick help would be greatly appreciated, since I have a project deadline in a couple of days.

[PinPinIre]

As of this morning I have also started to see this same error with the Github provider.

[zhouyua3253]

Specifying the issuer for GitHub resolves the issue.

providers: [
    GitHub({ issuer: "https://github.com/login/oauth" }),
]

[RadStr]

Specifying the issuer for GitHub resolves the issue.

providers: [
    GitHub({ issuer: "https://github.com/login/oauth" }),
]

Thank you, it does fix the issue. Really saved me from a lot of stress.

Anyways, I am keeping this issue open, since there might be more people with the same issue in the following days.

[hpsin]

Hey folks - this is detailed a bit more here: langfuse/langfuse#13091 - we (GitHub) rolled out iss support in our authz code response yesterday, and rolled it back this morning. With this issue and others, we found that client libraries were attempting to validate the iss field even though they had not been configured with one to validate against. This is why updating the providers field fixes it - it tells next-auth what the value should be, so that it doesn't fail closed.