Skip to content
OpenAdvisories

Vendor

@auth

3 known vulnerabilities.

Products

core 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.8
    CVE-2026-73419

    NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

    NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that cr…

    nextauthjs @auth next-auth core npm