Auth.js Email Normalizer Vulnerability: Potential Account Takeover Risk
An early warning has been issued regarding a potential vulnerability in the Auth.js email normalizer that could allow attackers to bypass email validation and potentially take over user accounts.
What happened
Reportedly, the default email-address normalizer used by the email/magic-link sign-in flow in Auth.js validates the address before applying Unicode normalization. This appears to allow a homoglyph '@' bypass, enabling an attacker to request a magic link that is delivered to an attacker-controlled mailbox, potentially leading to account takeover.
The affected components are @auth/core (npm) versions >=0.1.0,<0.41.3 and next-auth (npm) versions >=4.0.0,<4.24.14. The issue is under investigation, and it is recommended to upgrade to the first release containing the fix once it becomes available. For more details, consult the primary sources: [GHSA-7rqj-j65f-68wh](https://github.com/advisories/GHSA-7rqj-j65f-68wh) and [GHSA-8fpg-xm3f-6cx3](https://github.com/advisories/GHSA-8fpg-xm3f-6cx3).
Additionally, another issue [GHSA-8fpg-xm3f-6cx3](https://github.com/advisories/GHSA-8fpg-xm3f-6cx3) reports that configuration errors in Auth.js can cause existence-based authentication checks to fail open, further complicating the security posture. It is advisable to review your configurations and stay updated with the latest advisories.
How 0Day mitigates this
@auth/core is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.