Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    6 vulnerabilities found for core by @auth

    CVE-2026-73420 (GCVE-0-2026-73420)

    Vulnerability from nvd – Published: 2026-08-13 22:04 – Updated: 2026-08-14 15:06
    VLAI
    Title
    NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
    Summary
    NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer's single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim's email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
    Severity
    9.1 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-14 15:05 UTC
    CWE
    • CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize
    Assigner
    References
    Impacted products
    Vendor Product Version
    nextauthjs next-auth Affected: < 4.24.15
    Affected: >= 5.0.0-beta.4, < 5.0.0-beta.32
    		Create a notification for this product.
    @auth core Affected: >= 0.1.0, < 0.41.3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73420",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:05:10.354847Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:06:00.594Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "next-auth",
          "vendor": "nextauthjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.24.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.4, \u003c 5.0.0-beta.32"
            }
          ]
        },
        {
          "product": "core",
          "vendor": "@auth",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.1.0, \u003c 0.41.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer\u0027s single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim\u0027s email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-180",
              "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T22:04:15.414Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"
        }
      ],
      "source": {
        "advisory": "GHSA-7rqj-j65f-68wh",
        "discovery": "UNKNOWN"
      },
      "title": "NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73420",
    "datePublished": "2026-08-13T22:04:15.414Z",
    "dateReserved": "2026-08-12T14:32:11.795Z",
    "dateUpdated": "2026-08-14T15:06:00.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-73419 (GCVE-0-2026-73419)

    Vulnerability from nvd – Published: 2026-08-12 20:23 – Updated: 2026-08-13 15:32
    VLAI
    Title
    NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
    Summary
    NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider's authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker's target-provider account to the victim's Auth.js user. The linked provider grants the attacker persistent sign-in to the victim's account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-13 15:32 UTC
    CWE
    • CWE-345 - Insufficient Verification of Data Authenticity
    • CWE-346 - Origin Validation Error
    • CWE-940 - Improper Verification of Source of a Communication Channel
    Assigner
    References
    Impacted products
    Vendor Product Version
    nextauthjs next-auth Affected: < 4.24.15
    Affected: >= 5.0.0-beta.4, < 5.0.0-beta.32
    		Create a notification for this product.
    @auth core Affected: < 0.41.3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73419",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T15:32:05.776262Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T15:32:15.689Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "next-auth",
          "vendor": "nextauthjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.24.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.4, \u003c 5.0.0-beta.32"
            }
          ]
        },
        {
          "product": "core",
          "vendor": "@auth",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.41.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider\u0027s identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider\u0027s authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker\u0027s target-provider account to the victim\u0027s Auth.js user. The linked provider grants the attacker persistent sign-in to the victim\u0027s account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-940",
              "description": "CWE-940: Improper Verification of Source of a Communication Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T20:23:39.174Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-x445-f3h2-j279",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-x445-f3h2-j279"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/pull/13469",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/pull/13469"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/9f7a97fade9b1319bb9ac19fc9828d62e0a2a852",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/9f7a97fade9b1319bb9ac19fc9828d62e0a2a852"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"
        }
      ],
      "source": {
        "advisory": "GHSA-x445-f3h2-j279",
        "discovery": "UNKNOWN"
      },
      "title": "NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73419",
    "datePublished": "2026-08-12T20:23:39.174Z",
    "dateReserved": "2026-08-12T14:32:11.795Z",
    "dateUpdated": "2026-08-13T15:32:15.689Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-73418 (GCVE-0-2026-73418)

    Vulnerability from nvd – Published: 2026-08-12 20:21 – Updated: 2026-08-13 12:53
    VLAI
    Title
    NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
    Summary
    NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-13 12:53 UTC
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-248 - Uncaught Exception
    Assigner
    References
    Impacted products
    Vendor Product Version
    nextauthjs next-auth Affected: >= 4.0.6, <= 4.24.14
    Affected: >= 5.0.0-beta.0, <= 5.0.0-beta.31
    		Create a notification for this product.
    @auth core Affected: >= 0.1.0, < 0.41.3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73418",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T12:53:20.378207Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T12:53:44.683Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "next-auth",
          "vendor": "nextauthjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.6, \u003c= 4.24.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.0, \u003c= 5.0.0-beta.31"
            }
          ]
        },
        {
          "product": "core",
          "vendor": "@auth",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.1.0, \u003c 0.41.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T20:21:11.318Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xmf8-cvqr-rfgj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xmf8-cvqr-rfgj"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/pull/13469",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/pull/13469"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/e707770f00c52b3479e43422b0200b059149ed53",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/e707770f00c52b3479e43422b0200b059149ed53"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/%40auth%2Fcore%400.41.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/%40auth%2Fcore%400.41.3"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.24.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.24.15"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth%405.0.0-beta.32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth%405.0.0-beta.32"
        }
      ],
      "source": {
        "advisory": "GHSA-xmf8-cvqr-rfgj",
        "discovery": "UNKNOWN"
      },
      "title": "NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73418",
    "datePublished": "2026-08-12T20:21:11.318Z",
    "dateReserved": "2026-08-12T14:32:11.795Z",
    "dateUpdated": "2026-08-13T12:53:44.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-73420 (GCVE-0-2026-73420)

    Vulnerability from cvelistv5 – Published: 2026-08-13 22:04 – Updated: 2026-08-14 15:06
    VLAI
    Title
    NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
    Summary
    NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer's single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim's email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
    Severity
    9.1 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-14 15:05 UTC
    CWE
    • CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize
    Assigner
    References
    Impacted products
    Vendor Product Version
    nextauthjs next-auth Affected: < 4.24.15
    Affected: >= 5.0.0-beta.4, < 5.0.0-beta.32
    		Create a notification for this product.
    @auth core Affected: >= 0.1.0, < 0.41.3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73420",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:05:10.354847Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:06:00.594Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "next-auth",
          "vendor": "nextauthjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.24.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.4, \u003c 5.0.0-beta.32"
            }
          ]
        },
        {
          "product": "core",
          "vendor": "@auth",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.1.0, \u003c 0.41.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer\u0027s single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim\u0027s email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-180",
              "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T22:04:15.414Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"
        }
      ],
      "source": {
        "advisory": "GHSA-7rqj-j65f-68wh",
        "discovery": "UNKNOWN"
      },
      "title": "NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73420",
    "datePublished": "2026-08-13T22:04:15.414Z",
    "dateReserved": "2026-08-12T14:32:11.795Z",
    "dateUpdated": "2026-08-14T15:06:00.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-73419 (GCVE-0-2026-73419)

    Vulnerability from cvelistv5 – Published: 2026-08-12 20:23 – Updated: 2026-08-13 15:32
    VLAI
    Title
    NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
    Summary
    NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider's authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker's target-provider account to the victim's Auth.js user. The linked provider grants the attacker persistent sign-in to the victim's account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-13 15:32 UTC
    CWE
    • CWE-345 - Insufficient Verification of Data Authenticity
    • CWE-346 - Origin Validation Error
    • CWE-940 - Improper Verification of Source of a Communication Channel
    Assigner
    References
    Impacted products
    Vendor Product Version
    nextauthjs next-auth Affected: < 4.24.15
    Affected: >= 5.0.0-beta.4, < 5.0.0-beta.32
    		Create a notification for this product.
    @auth core Affected: < 0.41.3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73419",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T15:32:05.776262Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T15:32:15.689Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "next-auth",
          "vendor": "nextauthjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.24.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.4, \u003c 5.0.0-beta.32"
            }
          ]
        },
        {
          "product": "core",
          "vendor": "@auth",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.41.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider\u0027s identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider\u0027s authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker\u0027s target-provider account to the victim\u0027s Auth.js user. The linked provider grants the attacker persistent sign-in to the victim\u0027s account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-940",
              "description": "CWE-940: Improper Verification of Source of a Communication Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T20:23:39.174Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-x445-f3h2-j279",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-x445-f3h2-j279"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/pull/13469",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/pull/13469"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/9f7a97fade9b1319bb9ac19fc9828d62e0a2a852",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/9f7a97fade9b1319bb9ac19fc9828d62e0a2a852"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"
        }
      ],
      "source": {
        "advisory": "GHSA-x445-f3h2-j279",
        "discovery": "UNKNOWN"
      },
      "title": "NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73419",
    "datePublished": "2026-08-12T20:23:39.174Z",
    "dateReserved": "2026-08-12T14:32:11.795Z",
    "dateUpdated": "2026-08-13T15:32:15.689Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-73418 (GCVE-0-2026-73418)

    Vulnerability from cvelistv5 – Published: 2026-08-12 20:21 – Updated: 2026-08-13 12:53
    VLAI
    Title
    NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
    Summary
    NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-13 12:53 UTC
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-248 - Uncaught Exception
    Assigner
    References
    Impacted products
    Vendor Product Version
    nextauthjs next-auth Affected: >= 4.0.6, <= 4.24.14
    Affected: >= 5.0.0-beta.0, <= 5.0.0-beta.31
    		Create a notification for this product.
    @auth core Affected: >= 0.1.0, < 0.41.3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73418",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T12:53:20.378207Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T12:53:44.683Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "next-auth",
          "vendor": "nextauthjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.6, \u003c= 4.24.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.0, \u003c= 5.0.0-beta.31"
            }
          ]
        },
        {
          "product": "core",
          "vendor": "@auth",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.1.0, \u003c 0.41.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T20:21:11.318Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xmf8-cvqr-rfgj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xmf8-cvqr-rfgj"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/pull/13469",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/pull/13469"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/e707770f00c52b3479e43422b0200b059149ed53",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/e707770f00c52b3479e43422b0200b059149ed53"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/%40auth%2Fcore%400.41.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/%40auth%2Fcore%400.41.3"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.24.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.24.15"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth%405.0.0-beta.32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth%405.0.0-beta.32"
        }
      ],
      "source": {
        "advisory": "GHSA-xmf8-cvqr-rfgj",
        "discovery": "UNKNOWN"
      },
      "title": "NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73418",
    "datePublished": "2026-08-12T20:21:11.318Z",
    "dateReserved": "2026-08-12T14:32:11.795Z",
    "dateUpdated": "2026-08-13T12:53:44.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}