@auth core

• CVE-2026-73420 Critical 9.1 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass 0.7%
• CVE-2026-73419 Medium 6.8 NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them 0.2%
• CVE-2026-73418 High 7.5 NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers 0.9%