GHSA-7rqj-j65f-68wh: Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
The default email-address normalizer used by the email/magic-link sign-in flow validates the address before applying Unicode normalization. An address can contain a Unicode character that is not an ASCII @ (U+0040) but canonicalizes to one under NFKC/NFKD normalization (the normalization commonly applied by mail libraries and services for internationalized email). Such an address passes the normalizer’s single-@ check, but a downstream mail library that normalizes the string then sees two @ separators and may deliver the passwordless sign-in link to a different recipient than intended. This is an instance of validating before canonicalizing.
References
- github.com/advisories/GHSA-7rqj-j65f-68wh
- github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94
- github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0
- github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3
- github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15
- github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32
- github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh
Code Behaviors & Features
Detect and mitigate GHSA-7rqj-j65f-68wh with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →