CVE-2026-73419

Name of the Vulnerable Software and Affected Versions @auth/core versions prior to 0.41.3 next-auth versions prior to 4.24.15 next-auth versions prior to 5.0.0-beta.32

Description Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. During a callback, a check value generated during a sign-in process with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, such as the provider ID, issuer, client ID, or redirect URI. In multi-provider applications that allow account linking while logged in, an attacker can exploit this by luring a victim into a legitimate same-origin flow to link the attacker's target-provider account to the victim's user account, granting the attacker persistent access.

Recommendations Update @auth/core to version 0.41.3 or later. Update next-auth to version 4.24.15 or later. Update next-auth to version 5.0.0-beta.32 or later.