CVE-2026-73420 in NextAuth.js 4.24.13
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
- Severity
- Critical 9.1
- Exploitation
-
1% chance of exploit
in the next 30 days - Fix
- Update to 4.24.15, 5.0.0-beta.32
- Where
- App / API
- How it matched
- Exact version match
- Also known as
- GHSA-7rqj-j65f-68wh
- First seen
- 2026-11-05 01:13:58 UTC
- Source
- https://osv.dev/vulnerability/GHSA-7rqj-j65f-68wh