CVE-2026-47669

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the unzipDirectory function in packages/api/src/shell/unzipDirectory.js line 27 does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries writes files anywhere on the...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by unknown CVE via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-18306836...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73421 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73421 Source advisory: OSV:GHSA-8FPG-XM3F-6CX3...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73421 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73421 Source advisory: GHSA-8FPG-XM3F-6CX3...

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Impact next-auth Auth.js v5 applications that gate access by checking only for the existence of the auth object — the pattern shown in the official session management / protecting resources guide — are affected. When the Auth.js configuration produces a server-side error, the auth object exposed ...

NPM: Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

NPM: Auth.js: getToken throws an uncaught exception on malformed Bearer authorization headers vulnerability discovered by ? in WordPress Npm next-auth versions = 4.0.6, = 4.24.14...

Improper Check for Unusual or Exceptional Conditions

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the getToken function. An attacker can cause the application to throw an unhandled exception and disrupt service availability by sending...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +54 more potentially affected by CVE-2026-73418 via next-auth (>=4.1.2, <=4.24.13)

next-auth NPM version =4.1.2, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: CVE-2026-73418 Source advisory: OSV:GHSA-XMF8-CVQR-RFGJ...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by unknown CVE via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-18306959...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +54 more potentially affected by unknown CVE via next-auth (>=4.1.2, <=4.24.13)

next-auth NPM version =4.1.2, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-18306959...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73418 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73418 Source advisory: OSV:GHSA-XMF8-CVQR-RFGJ...

@12-apps/app-shell (>=1.0.0, <=5.13.1), @12-apps/auth (>=1.2.0, <=2.30.1) +268 more potentially affected by CVE-2026-73418 via @auth/core (>=0.1.0, <=0.41.2)

@auth/core NPM version =0.1.0, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 - @aponia.js/adapter-prisma 0.2.0 and more Source cves: CVE-2026-73418 Source...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +54 more potentially affected by CVE-2026-73418 via next-auth (>=4.1.2, <=4.24.13)

next-auth NPM version =4.1.2, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: CVE-2026-73418 Source advisory: GHSA-XMF8-CVQR-RFGJ...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73418 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73418 Source advisory: GHSA-XMF8-CVQR-RFGJ...

@12-apps/app-shell (>=1.0.0, <=5.13.1), @12-apps/auth (>=1.2.0, <=2.30.1) +268 more potentially affected by CVE-2026-73418 via @auth/core (>=0.1.0, <=0.41.2)

@auth/core NPM version =0.1.0, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 - @aponia.js/adapter-prisma 0.2.0 and more Source cves: CVE-2026-73418 Source...

@12-apps/app-shell (>=1.0.0, <=5.13.1), @12-apps/auth (>=1.2.0, <=2.30.1) +268 more potentially affected by unknown CVE via @auth/core (>=0.1.0, <=0.41.2)

@auth/core NPM version =0.1.0, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 - @aponia.js/adapter-prisma 0.2.0 and more Source cves: unknown CVE Source advisory...

NPM: Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

NPM: Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass vulnerability discovered by ? in WordPress Npm next-auth versions = 4.10.3, 4.24.15...

Incorrect Behavior Order: Validate Before Canonicalize

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +51 more potentially affected by CVE-2026-73420 via next-auth (>=4.10.3, <=4.24.13)

next-auth NPM version =4.10.3, =1.9.0, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =0.0.0-experimental-20251015143743, =0.0.0-experimental-20231123101256, =4.4.0 and more Source cves: CVE-2026-73420 Source advisory: OSV:GHSA-7RQJ-J65F-68WH...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +51 more potentially affected by CVE-2026-73420 via next-auth (>=4.10.3, <=4.24.13)

next-auth NPM version =4.10.3, =1.9.0, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =0.0.0-experimental-20251015143743, =0.0.0-experimental-20231123101256, =4.4.0 and more Source cves: CVE-2026-73420 Source advisory: GHSA-7RQJ-J65F-68WH...