NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-73420 · CVE overview and exploitation status

EUVD-2026-58519

GHSA-7rqj-j65f-68wh

cve-program · CVE-2026-73420

• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh
• https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94
• https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0
• https://github.com/nextauthjs/next-auth/releases/tag/@auth/[email protected]
• https://github.com/nextauthjs/next-auth/releases/tag/[email protected]
• https://github.com/nextauthjs/next-auth/releases/tag/[email protected]

euvd · EUVD-2026-58519

• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh
• https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94
• https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0
• https://github.com/nextauthjs/next-auth/releases/tag/@auth/[email protected]
• https://github.com/nextauthjs/next-auth/releases/tag/[email protected]
• https://github.com/nextauthjs/next-auth/releases/tag/[email protected]

nvd · CVE-2026-73420

• https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94
• https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0
• https://github.com/nextauthjs/next-auth/releases/tag/@auth/[email protected]
• https://github.com/nextauthjs/next-auth/releases/tag/[email protected]
• https://github.com/nextauthjs/next-auth/releases/tag/[email protected]
• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh

osv · GHSA-7rqj-j65f-68wh

• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh
• https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94
• https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0
• https://github.com/nextauthjs/next-auth
• https://github.com/nextauthjs/next-auth/releases/tag/@auth/[email protected]
• https://github.com/nextauthjs/next-auth/releases/tag/[email protected]
• https://github.com/nextauthjs/next-auth/releases/tag/[email protected]

No related changes are available here.