Skip to content
OpenAdvisories

Vendor

nextauthjs

14 known vulnerabilities.

Products

next-auth 14
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-73421

    NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

    NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server config…

    nextauthjs next-auth next-auth npm
  • Critical 9.1
    CVE-2026-73420

    NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

    NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can…

    nextauthjs @auth next-auth core Wolfi npm
  • Critical 9.1
    CVE-2022-35924

    Verification requests (magic link) sent to unwanted emails

    NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` either in versions before `4.10.3` or `3.29.10` are affected. If an attacker could forge a request that sent a comma-se…

    nextauthjs next-auth next-auth npm