nextauthjs next-auth

• CVE-2026-73421 Critical 9.1 NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error) 0.6%
• CVE-2026-73420 Critical 9.1 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass 0.7%
• CVE-2026-73419 Medium 6.8 NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them 0.2%
• CVE-2026-73418 High 7.5 NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers 0.9%
• CVE-2023-48309 Medium 5.3 next-auth vulnerable to possible user mocking that bypasses basic authentication 0.7%
• CVE-2023-27490 High 8.1 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth 0.5%
• CVE-2022-39263 Medium 6.8 NextAuth.js Upstash Adapter missing token verification 0.7%
• CVE-2022-35924 Critical 9.1 Verification requests (magic link) sent to unwanted emails 1.5%
• CVE-2022-31186 Low 3.3 Leakage of excessive information into log in next-auth 0.3%
• CVE-2022-31127 High 7.1 Improper handling of email input in next-auth 1.1%
• CVE-2022-31093 High 7.5 Improper Handling of `callbackUrl` parameter in next-auth 1.7%
• CVE-2022-29214 Medium 6.1 URL Redirection to Untrusted Site ('Open Redirect') in next-auth 0.7%
• CVE-2022-24858 Medium 6.1 Default redirect callback vulnerable to open redirects 0.8%
• CVE-2021-21310 Medium 6.1 Token verification bug in next-auth 1.7%