Anti-CSRF Vulnerability in NextAuth.js - Next.js Authentication Framework
CVE-2026-73419
6.8MEDIUM
What is CVE-2026-73419?
A vulnerability in NextAuth.js affects its handling of anti-CSRF checks, where global cookies are improperly managed. This allows an attacker to exploit the system by linking their own accounts to a victim's user in multi-provider applications, capitalizing on a lack of verification against the original provider during the callback phase. This scenario can lead to persistent unauthorized access to victims’ accounts. The issue has been addressed in subsequent updates: @auth/core version 0.41.3 and next-auth versions 4.24.15 and 5.0.0-beta.32.
Affected Version(s)
core < 0.41.3
next-auth < 4.24.15 < 4.24.15
next-auth >= 5.0.0-beta.4, < 5.0.0-beta.32 < 5.0.0-beta.4, 5.0.0-beta.32