NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer's single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim's email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and
    5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address
    before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH
    COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD
    normalization. The address passes the normalizer's single-at-sign check, but a downstream
    sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-
    sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient.
    Applications are affected when the email provider uses the built-in normalizer rather than a custom
    normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a
    victim's email address can request the misrouted magic link and sign in as the victim without victim
    interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
    (CVE-2026-73420)

ID	Name	Product	Family	Type	Severity
461309	Echo: next-auth: security update to 0.41.3	Tenable Cloud Security	Echo Local Security Checks	Local	critical
461309	Echo: next-auth: security update to 0.41.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
445218	SCA: security update for @auth/core, next-auth (GHSA-7rqj-j65f-68wh)	Tenable Cloud Security	SCA Checks	Local	critical
445218	SCA: security update for @auth/core, next-auth (GHSA-7rqj-j65f-68wh)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-73420

critical

Tenable Plugins

critical

critical

critical

critical