{"id":"GHSA-x445-f3h2-j279","revision":null,"records":[{"revision":"fc22232dadb345d9bb04af3888a92c9f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-73419","aliases":[],"title":"NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them","description":"NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider's authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker's target-provider account to the victim's Auth.js user. The linked provider grants the attacker persistent sign-in to the victim's account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.","state":0,"publishedAt":"2026-08-12T20:23:39.174+00:00","modifiedAt":"2026-08-13T15:32:15.689+00:00","affected":[{"ecosystem":"Vendor product","name":"next-auth","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"nextauthjs\",\n                    \"product\": \"next-auth\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.24.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 5.0.0-beta.4, < 5.0.0-beta.32\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@auth\",\n                    \"product\": \"core\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.41.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","score":6.8,"severity":"MEDIUM"}],"references":["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-x445-f3h2-j279","https://github.com/nextauthjs/next-auth/pull/13469","https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05","https://github.com/nextauthjs/next-auth/commit/9f7a97fade9b1319bb9ac19fc9828d62e0a2a852","https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-73419","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-73419","identifiers":["CVE-2026-73419"]},"retained":false,"historicalAffected":[]},{"revision":"c1b57b27624e4c37be5eb80d7b223647","observedAt":"2026-11-14T03:06:47.361+00:00","statement":{"source":"euvd","id":"EUVD-2026-57601","aliases":["CVE-2026-73419","GHSA-x445-f3h2-j279"],"title":"NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to t…","description":"NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider's authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker's target-provider account to the victim's Auth.js user. The linked provider grants the attacker persistent sign-in to the victim's account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","score":6.8,"severity":null}],"references":["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-x445-f3h2-j279","https://github.com/nextauthjs/next-auth/pull/13469","https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05","https://github.com/nextauthjs/next-auth/commit/9f7a97fade9b1319bb9ac19fc9828d62e0a2a852","https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-57601","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 12, 2026, 8:23:39 PM","dateUpdated":"Aug 13, 2026, 3:32:15 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-57601","identifiers":["EUVD-2026-57601","CVE-2026-73419","GHSA-x445-f3h2-j279"]},"retained":false,"historicalAffected":[]},{"revision":"a661ba6e8d7e45ce8ec51f03b0308a03","observedAt":"2026-10-25T15:19:09.409+00:00","statement":{"source":"nvd","id":"CVE-2026-73419","aliases":[],"title":"NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to t…","description":"NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider's authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker's target-provider account to the victim's Auth.js user. The linked provider grants the attacker persistent sign-in to the victim's account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.","state":0,"publishedAt":"2026-08-12T21:17:41.033+00:00","modifiedAt":"2026-09-09T20:58:37.713+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","score":6.8,"severity":"MEDIUM"}],"references":["https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05","https://github.com/nextauthjs/next-auth/commit/9f7a97fade9b1319bb9ac19fc9828d62e0a2a852","https://github.com/nextauthjs/next-auth/pull/13469","https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32","https://github.com/nextauthjs/next-auth/security/advisories/GHSA-x445-f3h2-j279"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73419","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-345","CWE-346","CWE-940"],"productCriteria":[],"sourceDates":{"published":"2026-08-12T21:17:41.033","lastModified":"2026-09-09T20:58:37.713"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-73419","identifiers":["CVE-2026-73419"]},"retained":false,"historicalAffected":[]},{"revision":"ef28470a62704732991ae9554f7d2fbf","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-x445-f3h2-j279","aliases":["CVE-2026-73419"],"title":"Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them","description":"## Summary\n\nAuth.js stores the OAuth/OIDC anti-CSRF checks (`state`, `nonce`, and the PKCE verifier) in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider, because the stored cookie is not verified against the callback provider's identity (provider id, issuer, client id, or redirect URI). In a multi-provider app that allows account linking while logged in, this provider-confusion / mix-up condition can let an attacker link their account at a second provider to a victim's user.\n\n## Am I affected?\n\nYou may be affected if **all** of the following hold:\n\n- You use `next-auth` `<= 4.24.14` or `>= 5.0.0-beta.1, <= 5.0.0-beta.31`, or `@auth/core` `<= 0.41.2`.\n- You configure multiple OAuth/OIDC providers.\n- You allow users to link additional providers while logged in.\n- At least one configured provider's authorization request is observable by an attacker, and at least one target provider's callback can be satisfied without a PKCE verifier (i.e. it relies only on `state` or only on `nonce`).\n\nYou are **not** affected if you use a single OAuth provider, do not allow logged-in account linking, or all providers enforce PKCE.\n\n## Impact\n\n- Account-linking confusion: an attacker can get their account at a target provider linked to the victim's Auth.js user, granting the attacker persistent sign-in to the victim's account through that linked provider.\n- Exploitation requires luring the victim into starting a legitimate same-origin flow; it cannot be performed by cross-site request forgery alone, which reduces practical likelihood.\n\n## Patched version\n\nThe fix binds the OAuth check cookies to the provider/authorization flow that created them, so a callback cannot consume a check value minted for a different provider. Upgrade to the first releases containing this fix (pending; this advisory will be updated with exact patched versions before publication).\n\n## Workarounds\n\nIf you cannot upgrade immediately:\n\n- Enable PKCE (`checks: [\"pkce\"]`, in addition to `state`/`nonce`) on every provider that supports it; PKCE blocks the practical code-swap variant because the attacker cannot observe the relying party's verifier.\n- Avoid offering logged-in account linking across multiple providers where one provider is lower-trust or attacker-observable.\n- Treat `events.linkAccount` as sensitive: add audit logging, user notification, or out-of-band confirmation so that any unexpected link is visible (defense-in-depth, not a root-cause fix).\n\n## Credit\n\nReported by @Nadav0077. Thank you for the responsible disclosure.","state":0,"publishedAt":"2026-07-23T14:31:51+00:00","modifiedAt":"2026-09-10T03:50:53.0950114+00:00","affected":[{"ecosystem":"npm","name":"@auth/core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.41.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"next-auth","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"5.0.0-beta.1"},{"kind":"fixed","version":"5.0.0-beta.32"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"next-auth","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.24.15"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-x445-f3h2-j279","https://nvd.nist.gov/vuln/detail/CVE-2026-73419","https://github.com/nextauthjs/next-auth/pull/13469","https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05","https://github.com/nextauthjs/next-auth/commit/9f7a97fade9b1319bb9ac19fc9828d62e0a2a852","https://github.com/nextauthjs/next-auth","https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"],"sourceUrl":"https://github.com/advisories/GHSA-x445-f3h2-j279","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-x445-f3h2-j279","identifiers":["GHSA-x445-f3h2-j279","CVE-2026-73419"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T12:00:55.3946839+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T12:00:55.3946839+00:00","lastSuccessAt":"2026-11-15T12:00:55.579435+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.5794357+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-9f2801eea6d0b63da2583193add6be220e1b53bbbe4ef94b9346425ef1596ca8","complete":true,"records":425788,"lastAttemptAt":"2026-11-15T12:00:54.4294537+00:00","lastSuccessAt":"2026-11-15T12:00:54.4082037+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.4294537+00:00","snapshotPublishedAt":"2026-11-15T11:26:58+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-850c26e23e9a454eb8654cf34d45fa51","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T12:10:42.9128167+00:00","lastSuccessAt":"2026-11-15T12:10:42.908+00:00","error":"92 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T12:10:42.908+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13568,"expectedIdentifiers":13874,"failedIdentifiers":92},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T12:00:55.3946839+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T12:00:55.3946839+00:00","lastSuccessAt":"2026-11-15T12:00:55.580236+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.580236+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d33b5144615b488f88b7a7390696bc39","complete":false,"records":13833,"lastAttemptAt":"2026-11-15T12:01:03.1788889+00:00","lastSuccessAt":"2026-11-15T10:02:36.038+00:00","error":"1 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T10:02:36.038+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13873,"expectedIdentifiers":13874,"failedIdentifiers":1},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T12:00:55.0947737+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.0947737+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T12:00:54.588948+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.588948+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T12:00:55.3229475+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.3229475+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T12:00:54.6916951+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.6916951+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}