CVE-2026-73421

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth wrapper can fail open when Auth.js has a server configuration error. In middleware, Route...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73421 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73421 Source advisory: MEND:CVE-2026-73421...

CVE-2026-73420

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...

CVE-2026-73420

CVE-2026-73420 affects NextAuth.js email/passwordless flows where the default email normalizer validates addresses before Unicode normalization. An address containing a homoglyph (e.g., U+FF20 FULLWIDTH COMMERCIAL AT) can canonicalize to a normal ASCII @ after NFKC/NFKD, causing downstream mail l...

EUVD-2026-58519

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73420 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73420 Source advisory: MEND:CVE-2026-73420...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +51 more potentially affected by CVE-2026-73420 via next-auth (>=4.10.3, <=4.24.13)

next-auth NPM version =4.10.3, =1.9.0, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =0.0.0-experimental-20251015143743, =0.0.0-experimental-20231123101256, =4.4.0 and more Source cves: CVE-2026-73420 Source advisory: MEND:CVE-2026-73420...

CVE-2026-73421: Improper Authorization

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth wrapper can fail open when Auth.js has a server configuration error. In middleware, Route...

CVE-2026-73418

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...

@app-box/web (1.0.0), @chirpy-dev/analytics (0.0.1) +87 more potentially affected by CVE-2026-73419 via next-auth (>=0.0.0-manual.83c4ebd1, <=4.24.13)

next-auth NPM version =0.0.0-manual.83c4ebd1, =0.1.0, =1.9.0, =3.0.0-canary.160.0, =2.0.1-canary.24.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.1 - @lowdefy/community-plugin-auth 1.0.4 and more Source cves: CVE-2026-73419 Source advisory: MEND:CVE-2026-73419...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73419 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73419 Source advisory: MEND:CVE-2026-73419...

CVE-2026-73418

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +54 more potentially affected by CVE-2026-73418 via next-auth (>=4.1.2, <=4.24.13)

next-auth NPM version =4.1.2, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: CVE-2026-73418 Source advisory: MEND:CVE-2026-73418...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73418 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73418 Source advisory: MEND:CVE-2026-73418...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by unknown CVE via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-18306836...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73421 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73421 Source advisory: GHSA-8FPG-XM3F-6CX3...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by CVE-2026-73421 via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: CVE-2026-73421 Source advisory: OSV:GHSA-8FPG-XM3F-6CX3...

NPM: Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

NPM: Auth.js: getToken throws an uncaught exception on malformed Bearer authorization headers vulnerability discovered by ? in WordPress Npm next-auth versions = 4.0.6, = 4.24.14...

Improper Check for Unusual or Exceptional Conditions

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the getToken function. An attacker can cause the application to throw an unhandled exception and disrupt service availability by sending...

@aangeles/jefeui (>=1.10.0, <=1.11.6), @aion0/forge (>=0.1.0, <=0.15.56) +67 more potentially affected by unknown CVE via next-auth (>=5.0.0-beta.3, <=5.0.0-beta.31)

next-auth NPM version =5.0.0-beta.3, =1.10.0, =0.1.0, =1.2.0, =0.1.0, =1.2.4-main.127b5b3.33, =0.0.2, =0.1.0-rc.1, =1.0.0, =0.1.6, =1.0.0, =0.106.0-rc.0, =1.0.16, =1.0.17 - @irshadkhan-dev/pandapulse-db 0.0.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-18306959...