Email Normalization Vulnerability in NextAuth.js Authentication for Next.js
CVE-2026-73420
9.1CRITICAL
What is CVE-2026-73420?
NextAuth.js, an authentication provider for Next.js, contains a vulnerability where the default normalizer used in its email and magic-link sign-in flow inaccurately validates email addresses. This issue arises when Unicode characters are involved, allowing addresses that appear valid to bypass checks. An attacker can exploit this by requesting a verification link sent to a victim's email, potentially allowing unauthorized access as the victim without any interaction needed from their side. This vulnerability can be mitigated by updating to specific versions where the flaw has been addressed.
Affected Version(s)
core >= 0.1.0, < 0.41.3
next-auth < 4.24.15 < 4.24.15
next-auth >= 5.0.0-beta.4, < 5.0.0-beta.32 < 5.0.0-beta.4, 5.0.0-beta.32