Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-73420: NextAuth.js email sign‑in can be hijacked with look‑alike address
CVE-2026-73420 · published 2 months ago
Summary
If you use NextAuth.js for password‑less email login, an attacker can craft an email address that looks normal but contains a special character that changes after processing. This can cause the verification link to be sent to the wrong inbox, letting the attacker sign in as the intended user. Upgrade to the latest versions of @auth/core and next‑auth to stop this from happening.
What to do
- Update auth core to version 0.41.3.
- Update better-gustavo next-auth to version 4.24.15.
- Update better-gustavo next-auth to version 5.0.0-beta.32.
- Update auth @auth/core to version 0.41.3.
- Update next-auth to version 4.24.15.
- Update next-auth to version 5.0.0-beta.32.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | auth | core |
>= 0.1.0, < 0.41.3 Fix: upgrade to 0.41.3
|
| npm | better-gustavo | next-auth |
>= 4.10.3, < 4.24.15 >= 5.0.0-beta.1, <= 5.0.0-beta.31 Fix: upgrade to 4.24.15
|
| – | nextauthjs | next-auth | < 4.24.15 |
| – | @auth | core | >= 0.1.0, < 0.41.3 |
| npm | auth | @auth/core |
>= 0.1.0, < 0.41.3 Fix: upgrade to 0.41.3
|
| npm | – | next-auth |
>= 4.10.3, < 4.24.15 >= 5.0.0-beta.1, < 5.0.0-beta.32 Fix: upgrade to 4.24.15
|
Original advisory text
NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer's single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim's email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
References
- https://github.com/advisories/GHSA-7rqj-j65f-68wh
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73420... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-73420 Vendor Advisory
- https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8... Patch
- https://github.com/nextauthjs/next-auth Product
- https://github.com/nextauthjs/next-auth/releases/tag/@auth/[email protected] URL
- https://github.com/nextauthjs/next-auth/releases/tag/[email protected] URL
- https://github.com/nextauthjs/next-auth/releases/tag/[email protected] URL
- https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh Vendor Advisory
- https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868... Patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-180Incorrect Behavior Order: Validate Before Canonicalize
Timeline
Published13 Aug 2026
Updated30 Oct 2026
First seen23 Jul 2026
Track software like this
Free during beta