{"id":"EUVD-2026-58519","enisaUuid":"6698944b-6b28-36c6-8504-67a227922422","description":"NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer\u0027s single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim\u0027s email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.","datePublished":"Aug 13, 2026, 10:04:15 PM","dateUpdated":"Aug 14, 2026, 3:06:00 PM","baseScore":9.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh\nhttps://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94\nhttps://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0\nhttps://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3\nhttps://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15\nhttps://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32\n","aliases":"CVE-2026-73420\nGHSA-7rqj-j65f-68wh\n","assigner":"GitHub_M","epss":0.73,"enisaIdProduct":[{"id":"44c59145-cec7-388b-96db-da1e37598058","product":{"name":"core","vendor":{"name":"OPNsense"}},"product_version":"0.1.0, \u003c 0.41.3"},{"id":"e986c41d-1318-307a-a886-7a68d65d032f","product":{"name":"next-auth","vendor":{"name":"nextauthjs"}},"product_version":"\u003c 4.24.15"},{"id":"f2951e79-b810-3797-87ff-7ef03e11f442","product":{"name":"next-auth","vendor":{"name":"nextauthjs"}},"product_version":"5.0.0-beta.4, \u003c 5.0.0-beta.32"}],"enisaIdVendor":[{"id":"a75b10f1-b2d5-3ba5-a83e-24fbb8b30a23","vendor":{"name":"nextauthjs"}},{"id":"ac5a4be8-5d77-37fe-b9c2-b453e8be9ff4","vendor":{"name":"@auth"}}],"enisaIdVulnerability":[{"id":"35944444-bd19-32e6-9d00-28bc3e5a8f28","vulnerability":{"id":"CVE-2026-73420","description":"NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer\u0027s single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim\u0027s email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.","datePublished":"Aug 13, 2026, 10:04:15 PM","dateUpdated":"Aug 14, 2026, 3:06:00 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh\nhttps://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94\nhttps://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0\nhttps://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3\nhttps://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15\nhttps://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32\n","enisa_id":"EUVD-2026-58519\n","assigner":"GitHub_M","epss":0.73,"dataProcessed":"Nov 11, 2026, 7:19:51 AM","vulnerabilityProduct":[{"id":"151234a1-023d-3863-8758-cf1a037bea57","product":{"name":"next-auth","vendor":{"name":"nextauthjs"}},"product_version":"5.0.0-beta.4, \u003c 5.0.0-beta.32"},{"id":"421ace53-c647-304f-8eb7-97c8f00fbd81","product":{"name":"core","vendor":{"name":"OPNsense"}},"product_version":"0.1.0, \u003c 0.41.3"},{"id":"5f9cafb3-b366-3b0f-9015-2f1c0eb2a599","product":{"name":"next-auth","vendor":{"name":"nextauthjs"}},"product_version":"\u003c 4.24.15"}],"vulnerabilityVendor":[{"id":"91a7a2e9-d839-3731-8a87-6e064db914b0","vendor":{"name":"@auth"}},{"id":"c8403db1-9522-3539-94e6-05fbccf741ec","vendor":{"name":"nextauthjs"}}]}},{"id":"7124be72-32f4-3ecd-abae-063eced5bb17","vulnerability":{"id":"GHSA-7rqj-j65f-68wh","description":"Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass","datePublished":"Jul 23, 2026, 2:40:15 PM","dateUpdated":"Aug 12, 2026, 8:27:03 PM","baseScore":0.0,"references":"https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh\nhttps://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94\nhttps://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0\nhttps://github.com/nextauthjs/next-auth\nhttps://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3\nhttps://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15\nhttps://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32\n","enisa_id":"EUVD-2026-58519\n","aliases":"CVE-2026-73420\nGHSA-7rqj-j65f-68wh\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:50:23 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}