Detections
Analytics

SCA: security update for @auth/core, next-auth (GHSA-7rqj-j65f-68wh)

critical Tenable Self-Hosted Container Security Plugin ID 445218

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and
 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address
 before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH
 COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD
 normalization. The address passes the normalizer's single-at-sign check, but a downstream
 sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-
 sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient.
 Applications are affected when the email provider uses the built-in normalizer rather than a custom
 normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a
 victim's email address can request the misrouted magic link and sign in as the victim without victim
 interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
 (CVE-2026-73420)

Solution

Update the @auth/core library and its related packages to version 0.41.3 or later.

See Also

https://github.com/advisories/GHSA-7rqj-j65f-68wh

Plugin Details

Severity: Critical

ID: 445218

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 7/23/2026

Updated: 8/14/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.58

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-73420

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.1

Threat Score: 6.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/23/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-73420

cwe: CWE-180