01 Record

CVE-2026-73420

NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

CriticalPUBLISHEDCNA: GitHub_M

Base score9.1 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

02 Description

NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Published: 2026-08-13 22:04Z20 HR AGO
Last updated: 2026-08-14 15:06Z3 HR AGO
Reserved: 2026-08-12
Assigning CNA: GitHub_M
Record state: PUBLISHED
Severity: Critical (CVSS 9.1)
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses: CWE-180
SSVC decision: ExploitationnoneAutomatableyesTechnical Impacttotal
Data version: 5.2
Document digest: ab35c78c8b097e36b322a64b14716f4da0a4b5b1fdf0d35ad9fb449859854ac8

VendorProductVersionsPlatforms

nextauthjsnext-auth< 4.24.15, >= 5.0.0-beta.4, < 5.0.0-beta.32—

@authcore>= 0.1.0, < 0.41.3—