Nextauthjs vulnerabilities
We track 7 vulnerabilities in Nextauthjs products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on August 13, 2026.
Latest Nextauthjs vulnerabilities
- 9.1 Critical severity
next-auth: Improper Authorization
NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configu
- 9.1 Critical severity
next-auth: Incorrect Behavior Order: Validate Before Canonicalize
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can
- 7.5 High severity
NextAuth.js provides authentication for Next.js.
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Author
- 8.8 High severity
next-auth: Cross-Site Request Forgery
NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the vi
- 8.1 High severity
next-auth: Improper Authentication
`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use `next-auth` Email Provider and `@next-auth/upstash-redis-adapter` before v3.0.2 are affected by this vulnerability
- 9.1 Critical severity
next-auth: Incorrect Authorization
NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` either in versions before `4.10.3` or `3.29.10` are affected. If an attacker could forge a request that sent a comma-sep
- 7.5 High severity
next-auth: Improper Check for Unusual or Exceptional Conditions
NextAuth.js is a complete open source authentication solution for Next.js applications. In affected versions an attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally is converted to a `URL` obje