{"action":"Upgrade @auth/core to 0.41.3 or later.","affected":[{"fixed":"0.41.3","introduced":"0"}],"component":"@auth/core","cve_ids":["CVE-2026-73419"],"ecosystem":"npm","epss":0.00249,"exploited":false,"fixed_versions":["0.41.3"],"ghsa_id":"GHSA-x445-f3h2-j279","id":"tcs_01M5KGGTENE4H5PW5XY7RR7TZ4","modified_at":"2026-09-10T03:50:53.095011411Z","published_at":"2026-07-23T14:31:51Z","references":["https://osv.dev/vulnerability/GHSA-x445-f3h2-j279","https://github.com/nextauthjs/next-auth/security/advisories/GHSA-x445-f3h2-j279","https://nvd.nist.gov/vuln/detail/CVE-2026-73419","https://github.com/nextauthjs/next-auth/pull/13469","https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05","https://github.com/nextauthjs/next-auth/commit/9f7a97fade9b1319bb9ac19fc9828d62e0a2a852","https://github.com/nextauthjs/next-auth","https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-x445-f3h2-j279","url":"https://osv.dev/vulnerability/GHSA-x445-f3h2-j279"}],"summary":"Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them"}