@auth/core vulnerabilities (npm)
3 vulnerabilities.
-
@auth/corenpm NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers 7.5 High -
@auth/corenpm NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass 9.1 Critical -
@auth/corenpm NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them 6.8 Medium