Email Address Spoofing in NextAuth.js

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer's single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim's email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73420

Affected Vendors & Products

Vendor	Product	Version / Range
auth	core	0.41.3
next-auth	next-auth	4.24.15
next-auth	next-auth	5.0.0-beta.32

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-180	The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.

Attack-Flow Graph

Executive Summary

This vulnerability affects NextAuth.js authentication in Next.js applications. It involves a Unicode normalization issue where an attacker can manipulate email addresses to bypass security checks. The defaultNormalizer validates email addresses before applying Unicode normalization, allowing a fullwidth commercial at sign (U+FF20) to pass as a single at sign. Downstream systems that normalize the address later may see two at signs, redirecting passwordless sign-in links to the attacker's email.

Impact Analysis

An attacker who knows your email address could request a passwordless sign-in link and receive it in their own inbox. They could then access your account without your interaction, potentially gaining unauthorized access to sensitive data or performing actions on your behalf.

Mitigation Strategies

Update to @auth/core 0.41.3 or later, next-auth 4.24.15 or later, or 5.0.0-beta.32 or later to fix the Unicode normalization issue in email validation.

Hi! I’m here to help you understand CVE-2026-73420. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70