Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

CVE-2026-73420

Fix: nextauthjs/next-auth@19d2feb

CVE-2026-73420 is a security vulnerability in @auth/core. O3 Security confirms whether CVE-2026-73420 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Published
Jul 23, 2026
Updated
Aug 12, 2026
Affected
3 pkgs
Patched
3 / 3
Exploits
None indexed
Exploitation data as of Aug 12, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

3 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

154other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
@auth/corenpm
4.1Mdownloads / week
next-authnpm
5.8Mdownloads / week

Description

Summary

The default email-address normalizer used by the email/magic-link sign-in flow validates the address before applying Unicode normalization. An address can contain a Unicode character that is not an ASCII @ (U+0040) but canonicalizes to one under NFKC/NFKD normalization (the normalization commonly applied by mail libraries and services for internationalized email). Such an address passes the normalizer's single-@ check, but a downstream mail library that normalizes the string then sees two @ separators and may deliver the passwordless sign-in link to a different recipient than intended. This is an instance of validating before canonicalizing.

Am I affected?

You may be affected if all of the following hold:

  • You use next-auth >= 4.0.0, < 4.24.14, or @auth/core >= 0.1.0, < 0.41.3.
  • You have the email / magic-link (passwordless) provider enabled.
  • You rely on the built-in default identifier normalizer (you have not supplied your own normalizeIdentifier).
  • Your sendVerificationRequest implementation uses a mail library or delivery service that applies Unicode normalization to recipient addresses (most internationalized-email/SMTPUTF8-capable senders do).

You are not affected if you do not use the email provider, or if your normalizer/mailer rejects or canonicalizes non-ASCII addresses before they are validated.

Impact

  • Account takeover: an attacker who knows a victim's email address can request a magic link that is delivered to an attacker-controlled mailbox, then use it to sign in as the victim.
  • No victim interaction is required to misroute the link; the attacker initiates the flow.

Patched version

The fix applies Unicode (NFKC) normalization before the address is validated, so homoglyph separators are collapsed and rejected up front. Upgrade to the first release containing this fix (pending; this advisory will be updated with the exact patched version before publication). No application code changes are required after upgrading.

Workarounds

If you cannot upgrade immediately:

  • Supply a custom normalizeIdentifier on the email provider that calls identifier.normalize("NFKC") (and lower-cases/trims) before any validation, and rejects addresses that do not contain exactly one @ after normalization.
  • Or reject any address whose local part or domain contains non-ASCII characters, if your user base does not require internationalized email addresses.

Credit

Reported by @kakashi-kx. Thank you for the responsible disclosure.

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
📦npm@auth/core≥ 0.1.0&&< 0.41.30.41.3
📦npmnext-auth≥ 4.10.3&&< 4.24.154.24.15
📦npmnext-auth≥ 5.0.0-beta.1&&< 5.0.0-beta.325.0.0-beta.32

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @auth/core. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

  2. Fix

    Update @auth/core to 0.41.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-73420 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 pinpoints whether CVE-2026-73420 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to CVE-2026-73420. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address **before** applying Unicode normalization. An address can contain a Unicode character that is not an ASCII `@` (U+0040) but canonicalizes to one under NFKC/NFKD normalization (the normalization commonly applied by mail libraries and services for internationalized email). Such an address passes the normalizer's single-`@` check, but a downstream mail library that normalizes the string then sees two `@` separators and may deliver the passwordless sign-in link to a different recipient
O3 Security · Impact-Aware SCA

Is CVE-2026-73420 in your dependencies?

O3 detects CVE-2026-73420 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works