What’s Vulnerable › Products

nextauthjs next-auth vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your nextauthjs next-auth version is affected

Latest nextauthjs next-auth vulnerabilities

• CVE-2026-73421 — NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error) (CVSS 9.1)
• CVE-2026-73420 — NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass (CVSS 9.1)
• CVE-2026-73419 — NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them (CVSS 6.8)
• CVE-2026-73418 — NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers (CVSS 7.5)
• CVE-2023-48309 — next-auth vulnerable to possible user mocking that bypasses basic authentication (CVSS 5.3)
• CVE-2023-27490 — Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth (CVSS 8.8)
• CVE-2022-39263 — NextAuth.js Upstash Adapter missing token verification (CVSS 8.1)
• CVE-2022-35924 — Verification requests (magic link) sent to unwanted emails (CVSS 9.1)
• CVE-2022-31127 — Improper handling of email input in next-auth (CVSS 6.1)
• CVE-2022-31093 — Improper Handling of `callbackUrl` parameter in next-auth (CVSS 7.5)
• CVE-2022-29214 — URL Redirection to Untrusted Site ('Open Redirect') in next-auth (CVSS 6.1)
• CVE-2022-24858 — Default redirect callback vulnerable to open redirects (CVSS 6.1)
• CVE-2021-21310 — Token verification bug in next-auth (CVSS 5.9)