Skip to content
OpenAdvisories

Product · @auth

core

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-73418

    NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

    NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Autho…

    nextauthjs @auth next-auth core npm