core vulnerabilities

2 known vulnerabilities in core from @auth. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  next-auth: Incorrect Behavior Order: Validate Before Canonicalize

  CVE-2026-73420Aug 13, 2026Nextauthjs

  NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can

• 7.5 High severity

  NextAuth.js provides authentication for Next.js.

  CVE-2026-73418Aug 12, 2026Nextauthjs

  NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Author