GHSA-7rqj-j65f-68wh: Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
(updated )
The default email-address normalizer used by the email/magic-link sign-in flow validates the address before applying Unicode normalization. An address can contain a Unicode character that is not an ASCII @ (U+0040) but canonicalizes to one under NFKC/NFKD normalization (the normalization commonly applied by mail libraries and services for internationalized email). Such an address passes the normalizer’s single-@ check, but a downstream mail library that normalizes the string then sees two @ separators and may deliver the passwordless sign-in link to a different recipient than intended. This is an instance of validating before canonicalizing.
References
- github.com/advisories/GHSA-7rqj-j65f-68wh
- github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94
- github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0
- github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3
- github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15
- github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32
- github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh
- nvd.nist.gov/vuln/detail/CVE-2026-73420
Code Behaviors & Features
Detect and mitigate GHSA-7rqj-j65f-68wh with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →