What is CVE-2026-73420?
CVE-2026-73420 is a vulnerability in NextAuth.js where the email and magic-link sign-in validates an address before Unicode normalization. This could allow an attacker to create a visually identical but different email address using special Unicode characters (e.g., U+FF) to hijack accounts. Users should update to @auth/core 0.41.3, next-auth 4.24.15, or 5.0.0-beta.32.
Azərbaycanca: CVE-2026-73420 NextAuth.js autentifikasiya kitabxanasında e-poçt və magic-link girişində Unicode normalizasiyasından əvvəl doğrulama zəifliyidir. Təcavüzkar xüsusi Unicode simvollarla (məsələn, U+FF) eyni görünən fərqli e-poçt ünvanı yaradaraq hesab ələ keçirə bilər. @auth/core 0.41.3, next-auth 4.24.15 və ya 5.0.0-beta.32 versiyalarına yenilənməlidir.
Related CVEs
link basis: same weakness class CWE-20
FAQ2
Which authentication methods in NextAuth.js are affected by CVE-2026-73420?
This vulnerability affects the email and magic-link sign-in methods, because address validation is performed before Unicode normalization.
Which versions should be updated to fix CVE-2026-73420?
Users should update to @auth/core 0.41.3, next-auth 4.24.15, or 5.0.0-beta.32.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.