Vulnerabilities

TI-2026-51538 CVE-2026-73420 · GHSA-7rqj-j65f-68wh

NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

MEDIUM 48

NextAuth.js provides authentication for Next.js.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00725 Published 2026-08-13 Fixed in 4.24.15, 5.0.0-beta.32 +1 CWE-180

TI-2026-51537 CVE-2026-73419 · GHSA-x445-f3h2-j279

LOW 32

NextAuth.js provides authentication for Next.js.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00249 Published 2026-08-12 Fixed in 4.24.15, 5.0.0-beta.32 +1 CWE-345

TI-2026-51536 CVE-2026-73418 · GHSA-xmf8-cvqr-rfgj

MEDIUM 40

NextAuth.js provides authentication for Next.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00877 Published 2026-08-12 Fixed in 0.41.3, 5.0.0-beta.32 +1 CWE-20