nextauthjs next-auth vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20227
3. 20232
4. 20264

Newest CVEs

• CVE-2026-73421

  NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

  nextauthjs · next-auth

  Critical9.1
• CVE-2026-73420

  NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

  nextauthjs · next-auth

  Critical9.1
• CVE-2026-73419

  NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

  nextauthjs · next-auth

  Medium6.8
• CVE-2026-73418

  NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

  nextauthjs · next-auth

  High7.5
• CVE-2023-48309

  next-auth vulnerable to possible user mocking that bypasses basic authentication

  nextauthjs · next-auth

  Medium5.3
• CVE-2023-27490

  Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth

  nextauthjs · next-auth

  High8.1
• CVE-2022-39263

  NextAuth.js Upstash Adapter missing token verification

  nextauthjs · next-auth

  Medium6.8
• CVE-2022-35924

  Verification requests (magic link) sent to unwanted emails

  nextauthjs · next-auth

  Critical9.1
• CVE-2022-31186

  Leakage of excessive information into log in next-auth

  nextauthjs · next-auth

  Low3.3
• CVE-2022-31127

  Improper handling of email input in next-auth

  nextauthjs · next-auth

  High7.1