Skip to content
@@auth
Products
| Product | CVEs | Exploited | Latest |
|---|
| core | 3 | – | Aug 13, 2026 |
Exploited and recent CVEs
-
CVE-2026-73420
Critical 9.1
NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
0.7%
-
CVE-2026-73419
Medium 6.8
NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
0.2%
-
CVE-2026-73418
High 7.5
NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
0.9%