@auth core vulnerabilities
3 published CVEs name @auth core among the affected products.
- 3Published CVEs3 of them scored
- 3Last 12 monthspublished in the last year
- 1Critical1 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-73420
NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
nextauthjs · next-auth
Critical9.1 - CVE-2026-73419
NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
nextauthjs · next-auth
Medium6.8 - CVE-2026-73418
NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
nextauthjs · next-auth
High7.5