CVE-2026-73420

creationtimestamp| type| source ---|---|--- 2026-08-13 23:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msyrstfqbh2e 2026-08-14 01:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/117091272429906586 2026-08-14 01:30:29+00:00| seen|...

CVE-2026-73420

CVE-2026-73420 affects NextAuth.js email/passwordless flows where the default email normalizer validates addresses before Unicode normalization. An address containing a homoglyph (e.g., U+FF20 FULLWIDTH COMMERCIAL AT) can canonicalize to a normal ASCII @ after NFKC/NFKD, causing downstream mail l...

CVE-2026-73420 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...

CVE-2026-73420 vulnerabilities

Vulnerabilities for packages: langfuse, langfuse-fips, jitsucom-jitsu...