@auth vulnerabilities
We track 2 vulnerabilities in @auth products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 13, 2026.
2vulnerabilities
1critical
1high
0exploited
8.3average CVSS score
Latest @auth vulnerabilities
- 9.1 Critical severity
next-auth: Incorrect Behavior Order: Validate Before Canonicalize
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can
- 7.5 High severity
NextAuth.js provides authentication for Next.js.
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Author