NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider's authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker's target-provider account to the victim's Auth.js user. The linked provider grants the attacker persistent sign-in to the victim's account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and
    5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in
    global cookies that are not bound to the provider that created them. On callback, a check value minted
    during a sign-in started with one provider can satisfy the callback for a different provider because the
    stored cookie is not verified against the callback provider's identity, including the provider ID, issuer,
    client ID, or redirect URI. In a multi-provider application that permits account linking while logged in,
    when one provider's authorization request is observable and a target provider callback can be satisfied
    without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and
    link the attacker's target-provider account to the victim's Auth.js user. The linked provider grants the
    attacker persistent sign-in to the victim's account, while cross-site request forgery alone is
    insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
    (CVE-2026-73419)

ID	Name	Product	Family	Type	Severity
465076	Echo: next-auth: security update to 0.41.3	Tenable Cloud Security	Echo Local Security Checks	Local	medium
465076	Echo: next-auth: security update to 0.41.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
445219	SCA: security update for @auth/core, next-auth (GHSA-x445-f3h2-j279)	Tenable Cloud Security	SCA Checks	Local	medium
445219	SCA: security update for @auth/core, next-auth (GHSA-x445-f3h2-j279)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-73419

medium

Tenable Plugins

medium

medium

medium

medium