npm/@auth/core CVE-2026-73420: critical, EPSS 0.73%

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Action: Upgrade @auth/core to 0.41.3 or later.

npm i @auth/core@0.41.3

Affected

Fixed versions

Sources

• osv: GHSA-7rqj-j65f-68wh
• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh
• https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94
• https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0
• https://github.com/nextauthjs/next-auth
• https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3
• https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15
• https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32

CVE-2026-73420 · published 2026-07-23T14:40:15Z · modified 2026-09-10T03:50:51.566945120Z · JSON