NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
Summary
| CVE | CVE-2026-73420 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-13 22:17:26 UTC |
| Updated | 2026-08-13 22:17:26 UTC |
| Description | NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer's single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim's email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32. |
Risk And Classification
Primary CVSS: v4.0 9.1 CRITICAL from [email protected]
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-180 | CWE-180 CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 9.1 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | DECLARED | 9.1 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
PresentPrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
HighAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Nextauthjs | Next-auth | affected < 4.24.15 | Not specified |
| CNA | Nextauthjs | Next-auth | affected >= 5.0.0-beta.4, < 5.0.0-beta.32 | Not specified |
| CNA | @auth | Core | affected >= 0.1.0, < 0.41.3 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868... | [email protected] | github.com | |
| github.com/nextauthjs/next-auth/releases/tag/[email protected] | [email protected] | github.com | |
| github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh | [email protected] | github.com | |
| github.com/nextauthjs/next-auth/releases/tag/@auth/[email protected] | [email protected] | github.com | |
| github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8... | [email protected] | github.com | |
| github.com/nextauthjs/next-auth/releases/tag/[email protected] | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.