Nextauthjs Next-auth vulnerabilities

• nextauthjs next-auth NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error) CVE-2026-73421 Fix available 9.1 CriticalJuly 23, 2026
• @auth core, nextauthjs next-auth +1 more NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers CVE-2026-73418 Fix available 7.5 HighJuly 23, 2026
• @auth core, nextauthjs next-auth +1 more NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass CVE-2026-73420 Fix available 9.1 CriticalJuly 23, 2026
• @auth core, nextauthjs next-auth +1 more NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them CVE-2026-73419 Fix available 6.8 MediumJuly 23, 2026
• nextauth.js next-auth next-auth vulnerable to possible user mocking that bypasses basic authentication CVE-2023-48309 Fix available 5.3 MediumNovember 20, 2023
• nextauth.js next-auth Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth CVE-2023-27490 Fix available 8.1 HighMarch 9, 2023
• nextauth.js next-auth NextAuth.js Upstash Adapter missing token verification CVE-2022-39263 Fix available 6.8 MediumSeptember 28, 2022
• nextauth.js next-auth Verification requests (magic link) sent to unwanted emails CVE-2022-35924 Fix available 9.1 CriticalAugust 2, 2022
• next-auth nextauth.js, nextauthjs next-auth +1 more Leakage of excessive information into log in next-auth CVE-2022-31186 Fix available 3.3 LowAugust 1, 2022
• nextauth.js next-auth Improper handling of email input in next-auth CVE-2022-31127 Fix available 7.1 HighJuly 6, 2022
• nextauth.js next-auth Improper Handling of `callbackUrl` parameter in next-auth CVE-2022-31093 Fix available 7.5 HighJune 21, 2022
• nextauth.js next-auth URL Redirection to Untrusted Site ('Open Redirect') in next-auth CVE-2022-29214 Fix available 6.1 MediumMay 20, 2022
• nextauth.js next-auth Default redirect callback vulnerable to open redirects CVE-2022-24858 Fix available 6.1 MediumApril 19, 2022
• nextauth.js next-auth Token verification bug in next-auth CVE-2021-21310 Fix available 6.1 MediumFebruary 11, 2021