Auth.js Email Normalizer Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- @auth/core (npm)
- Affected versions
- >= 0.1.0, < 0.41.3 or < 0.41.3 or >= 0.1.0, < 0.41.3
- Patched version
- Not yet available
An early warning has been issued for a high-severity vulnerability in the Auth.js email normalizer. This issue, which is under investigation, may allow an attacker to bypass email validation using homoglyphs, potentially leading to account takeover.
What happened
The vulnerability reportedly affects the default email-address normalizer used by the email/magic-link sign-in flow in Auth.js. The normalizer validates the email address before applying Unicode normalization, which allows a homoglyph @ bypass. This can lead to account takeover if an attacker requests a magic link that is delivered to an attacker-controlled mailbox.
The affected components include @auth/core (npm) and next-auth (npm). The exact version ranges affected are detailed in the threat data. This advisory is based on the GitHub Advisory Database entry GHSA-7RQJ-J65F-68WH.
What to do about it
- Monitor the primary sources for updates on the vulnerability.
- Check your dependencies for affected versions of @auth/core and next-auth.
- Upgrade to the first release containing the fix once it is available. This advisory will be updated with the exact patched version.
- If you are using affected versions, consider implementing additional validation checks to mitigate the risk until a fix is released.
How 0Day would have caught this
@auth/core is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using @auth/core (npm) versions >= 0.1.0, < 0.41.3 or next-auth (npm) versions < 4.24.12, >= 5.0.0-beta.0, < 5.0.0-beta.30, or other specified versions. Check the threat data for the full list of affected versions.
What should I do right now?
Monitor the primary sources for updates and check your dependencies for affected versions. Upgrade to the first release containing the fix once it is available.
When will a fix be available?
The exact patched version is pending. This advisory will be updated with the information once it is available. Monitor the sources for updates.