CVE-2026-73418 NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...

CVE-2026-73418

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...

Malicious code in sme-auth-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3d46bc99b3f8904f9d24bfac1600b245fe39af77d713acf1ee761bb57212f3c On require'sme-auth-core', index.js loads init.js which platform-selects a URL and fetches an opaque binary from one of three string-obfuscated...

MAL-2026-12207 Malicious code in sme-auth-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3d46bc99b3f8904f9d24bfac1600b245fe39af77d713acf1ee761bb57212f3c On require'sme-auth-core', index.js loads init.js which platform-selects a URL and fetches an opaque binary from one of three string-obfuscated...

@12-apps/app-shell (>=1.0.0, <=5.7.0), @12-apps/auth (>=1.2.0, <=2.19.0) +282 more potentially affected by unknown CVE via @auth/core (>=0.1.0, <=0.41.2)

@auth/core NPM version =0.1.0, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 and more Source cves: unknown CVE Source advisory: SNYK:JS-AUTHCORE-18306960...

@12-apps/app-shell (>=1.0.0, <=5.7.0), @12-apps/auth (>=1.2.0, <=2.19.0) +282 more potentially affected by CVE-2026-73418 via @auth/core (>=0.1.0, <=0.41.2)

@auth/core NPM version =0.1.0, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 and more Source cves: CVE-2026-73418 Source advisory: OSV:GHSA-XMF8-CVQR-RFGJ...

@12-apps/app-shell (>=1.0.0, <=5.7.0), @12-apps/auth (>=1.2.0, <=2.19.0) +282 more potentially affected by unknown CVE via @auth/core (>=0.1.0, <=0.41.2)

@auth/core NPM version =0.1.0, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 and more Source cves: unknown CVE Source advisory: SNYK:JS-AUTHCORE-18306877...

@12-apps/app-shell (>=1.0.0, <=5.7.0), @12-apps/auth (>=1.2.0, <=2.19.0) +282 more potentially affected by CVE-2026-73420 via @auth/core (>=0.1.0, <=0.41.2)

@auth/core NPM version =0.1.0, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 and more Source cves: CVE-2026-73420 Source advisory: OSV:GHSA-7RQJ-J65F-68WH...

@12-apps/app-shell (>=1.0.0, <=5.7.0), @12-apps/auth (>=1.2.0, <=2.19.0) +284 more potentially affected by CVE-2026-73419 via @auth/core (>=0.0.0-manual.fdbc96ab, <=0.41.2)

@auth/core NPM version =0.0.0-manual.fdbc96ab, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 and more Source cves: CVE-2026-73419 Source advisory:...

@12-apps/app-shell (>=1.0.0, <=5.7.0), @12-apps/auth (>=1.2.0, <=2.19.0) +284 more potentially affected by unknown CVE via @auth/core (>=0.0.0-manual.fdbc96ab, <=0.41.2)

@auth/core NPM version =0.0.0-manual.fdbc96ab, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 and more Source cves: unknown CVE Source advisory:...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +189 more potentially affected by CVE-2026-53516 via @better-auth/core (>=1.3.18, <=1.6.10)

@better-auth/core NPM version =1.3.18, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.3.18, =1.5.0-beta.13 and more Source cves: CVE-2026-53516 Source advisory: SNYK:JS-BETTERAUTHCORE-17889819...

Authentication Bypass Using an Alternate Path or Channel

Overview @better-auth/core is a The most comprehensive authentication framework for TypeScript. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the handleOAuthUserInfo. An attacker can gain unauthorized access to user accounts by...

python311-social-auth-core-4.8.7-1.1 on GA media (moderate)

python311-social-auth-core-4.8.7-1.1 on GA media Announcement ID: openSUSE-SU-2026:10681-1 Rating: moderate Cross-References: CVE-2026-32597 CVSS scores: CVE-2026-32597 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2026-32597 SUSE : 8.7...

Malicious code in @telekom-wfa/auth-core (npm)

Package is malware. Hardcoded Telegram credentials, data exfiltration, and preinstall script execution indicate malicious intent. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a2fe12e5542ae8cf1cf339c13c3480629ccfd6e2fb391427c4f1b17bbdc9f85 The package...

MAL-2026-2523 Malicious code in @telekom-wfa/auth-core (npm)

Package is malware. Hardcoded Telegram credentials, data exfiltration, and preinstall script execution indicate malicious intent. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a2fe12e5542ae8cf1cf339c13c3480629ccfd6e2fb391427c4f1b17bbdc9f85 The package...

@12-apps/app-shell (>=1.0.0, <=5.7.0), @12-apps/auth (>=1.2.0, <=2.19.0) +273 more potentially affected by unknown CVE via @auth/core (>=0.0.0-manual.fdbc96ab, <=0.41.0)

@auth/core NPM version =0.0.0-manual.fdbc96ab, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 and more Source cves: unknown CVE Source advisory:...

EUVD-2022-4301

Malicious code in bioql PyPI...

Malicious code in next-auth-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0038c51339b63eb3fe77a5d623ae004832f05cc831ff582362d202f30a49072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3794 Malicious code in next-auth-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0038c51339b63eb3fe77a5d623ae004832f05cc831ff582362d202f30a49072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7188 Malicious code in wm-accounts-auth-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1cdd1cfc8b0646198270138deb5824d92d72858377c39f84124570e1273629a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...