criticalnext-authCVE-2026-73420
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
Affected versions
>= 4.10.3, < 4.24.15, fixed in 4.24.15>= 5.0.0-beta.1, <= 5.0.0-beta.31, fixed in 5.0.0-beta.32
Published 2026-07-23. Last checked 2026-11-01. Read the source advisory