CVE-2026-73420

Name of the Vulnerable Software and Affected Versions @auth/core versions prior to 0.41.3 next-auth versions prior to 4.24.15 next-auth versions prior to 5.0.0-beta.32

Description The defaultNormalizer used in the email and magic-link sign-in flow validates an email address before applying Unicode normalization. An attacker can use a Unicode character, such as U+FF20 FULLWIDTH COMMERCIAL AT, which is not an ASCII at-sign but canonicalizes to one under NFKC or NFKD normalization. This allows the address to pass the single-at-sign check. If a downstream sendVerificationRequest mail library or delivery service applies Unicode normalization, it may detect two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. This occurs when the email provider uses the built-in normalizer instead of a custom normalizeIdentifier and the downstream sender performs Unicode normalization. An attacker knowing a victim's email address can request a misrouted magic link to sign in as the victim without their interaction.

Recommendations Update @auth/core to version 0.41.3 or later. Update next-auth to version 4.24.15 or later. Update next-auth to version 5.0.0-beta.32 or later. As a temporary mitigation, use a custom normalizeIdentifier instead of the built-in normalizer.