Vulnerabilities in @auth

3 results

CVE-2026-73418HIGHNextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headersEPSS 0.9%CVE-2026-73420CRITICALNextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypassEPSS 0.7%CVE-2026-73419MEDIUMNextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created themEPSS 0.2%