pwnmyvibecode_

Auth.js (NextAuth) vulnerabilities and security advisories

The newest reviewed advisories for next-auth and @auth/core on npm. Each one shows which versions are affected, which version fixes it, and a prompt that has your AI agent check your project and upgrade only if it needs to.

Get an email when Auth.js (NextAuth) has a new one

Email alerts are coming soon. This page updates every hour.

$ latest 14 · 7 critical, high or exploited

  • criticalJul 23, 2026

    Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

    • next-auth >= 5.0.0-beta.0, <= 5.0.0-beta.31 · fixed in 5.0.0-beta.32
    GHSA-8fpg-xm3f-6cx3CVE-2026-73421
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-8fpg-xm3f-6cx3 (CVE-2026-73421), severity critical
What it is: Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
Affected packages:
- next-auth: affected versions >= 5.0.0-beta.0, <= 5.0.0-beta.31. Fixed in 5.0.0-beta.32.
Details: https://github.com/advisories/GHSA-8fpg-xm3f-6cx3

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJul 23, 2026

    Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

    • @auth/core >= 0.1.0, < 0.41.3 · fixed in 0.41.3
    • next-auth >= 5.0.0-beta.0, <= 5.0.0-beta.31 · fixed in 5.0.0-beta.32
    • next-auth >= 4.0.6, <= 4.24.14 · fixed in 4.24.15
    GHSA-xmf8-cvqr-rfgjCVE-2026-73418
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-xmf8-cvqr-rfgj (CVE-2026-73418), severity high
What it is: Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
Affected packages:
- @auth/core: affected versions >= 0.1.0, < 0.41.3. Fixed in 0.41.3.
- next-auth: affected versions >= 5.0.0-beta.0, <= 5.0.0-beta.31. Fixed in 5.0.0-beta.32.
- next-auth: affected versions >= 4.0.6, <= 4.24.14. Fixed in 4.24.15.
Details: https://github.com/advisories/GHSA-xmf8-cvqr-rfgj

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • criticalJul 23, 2026

    Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

    • @auth/core >= 0.1.0, < 0.41.3 · fixed in 0.41.3
    • next-auth >= 4.10.3, < 4.24.15 · fixed in 4.24.15
    • next-auth >= 5.0.0-beta.1, <= 5.0.0-beta.31 · fixed in 5.0.0-beta.32
    GHSA-7rqj-j65f-68whCVE-2026-73420
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-7rqj-j65f-68wh (CVE-2026-73420), severity critical
What it is: Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
Affected packages:
- @auth/core: affected versions >= 0.1.0, < 0.41.3. Fixed in 0.41.3.
- next-auth: affected versions >= 4.10.3, < 4.24.15. Fixed in 4.24.15.
- next-auth: affected versions >= 5.0.0-beta.1, <= 5.0.0-beta.31. Fixed in 5.0.0-beta.32.
Details: https://github.com/advisories/GHSA-7rqj-j65f-68wh

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJul 23, 2026

    Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

    • @auth/core <= 0.41.2 · fixed in 0.41.3
    • next-auth >= 5.0.0-beta.1, <= 5.0.0-beta.31 · fixed in 5.0.0-beta.32
    • next-auth <= 4.24.14 · fixed in 4.24.15
    GHSA-x445-f3h2-j279CVE-2026-73419
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-x445-f3h2-j279 (CVE-2026-73419), severity medium
What it is: Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Affected packages:
- @auth/core: affected versions <= 0.41.2. Fixed in 0.41.3.
- next-auth: affected versions >= 5.0.0-beta.1, <= 5.0.0-beta.31. Fixed in 5.0.0-beta.32.
- next-auth: affected versions <= 4.24.14. Fixed in 4.24.15.
Details: https://github.com/advisories/GHSA-x445-f3h2-j279

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumOct 29, 2025

    NextAuthjs Email misdelivery Vulnerability

    • next-auth < 4.24.12 · fixed in 4.24.12
    • next-auth >= 5.0.0-beta.0, < 5.0.0-beta.30 · fixed in 5.0.0-beta.30
    GHSA-5jpx-9hw9-2fx4
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-5jpx-9hw9-2fx4, severity medium
What it is: NextAuthjs Email misdelivery Vulnerability
Affected packages:
- next-auth: affected versions < 4.24.12. Fixed in 4.24.12.
- next-auth: affected versions >= 5.0.0-beta.0, < 5.0.0-beta.30. Fixed in 5.0.0-beta.30.
Details: https://github.com/advisories/GHSA-5jpx-9hw9-2fx4

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumNov 20, 2023

    Possible user mocking that bypasses basic authentication

    • next-auth < 4.24.5 · fixed in 4.24.5
    GHSA-v64w-49xw-qq89CVE-2023-48309
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-v64w-49xw-qq89 (CVE-2023-48309), severity medium
What it is: Possible user mocking that bypasses basic authentication
Affected packages:
- next-auth: affected versions < 4.24.5. Fixed in 4.24.5.
Details: https://github.com/advisories/GHSA-v64w-49xw-qq89

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highMar 13, 2023

    Missing proper state, nonce and PKCE checks for OAuth authentication

    • next-auth < 4.20.1 · fixed in 4.20.1
    GHSA-7r7x-4c4q-c4qfCVE-2023-27490
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-7r7x-4c4q-c4qf (CVE-2023-27490), severity high
What it is: Missing proper state, nonce and PKCE checks for OAuth authentication
Affected packages:
- next-auth: affected versions < 4.20.1. Fixed in 4.20.1.
Details: https://github.com/advisories/GHSA-7r7x-4c4q-c4qf

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • lowAug 6, 2022

    next-auth before v4.10.2 and v3.29.9 leaks excessive information into log

    • next-auth < 3.29.9 · fixed in 3.29.9
    • next-auth >= 4.0.0, < 4.10.2 · fixed in 4.10.2
    GHSA-p6mm-27gq-9v3pCVE-2022-31186
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-p6mm-27gq-9v3p (CVE-2022-31186), severity low
What it is: next-auth before v4.10.2 and v3.29.9 leaks excessive information into log
Affected packages:
- next-auth: affected versions < 3.29.9. Fixed in 3.29.9.
- next-auth: affected versions >= 4.0.0, < 4.10.2. Fixed in 4.10.2.
Details: https://github.com/advisories/GHSA-p6mm-27gq-9v3p

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • criticalAug 2, 2022

    NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails

    • next-auth >= 4.0.0, < 4.10.3 · fixed in 4.10.3
    • next-auth < 3.29.10 · fixed in 3.29.10
    GHSA-xv97-c62v-4587CVE-2022-35924
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-xv97-c62v-4587 (CVE-2022-35924), severity critical
What it is: NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails
Affected packages:
- next-auth: affected versions >= 4.0.0, < 4.10.3. Fixed in 4.10.3.
- next-auth: affected versions < 3.29.10. Fixed in 3.29.10.
Details: https://github.com/advisories/GHSA-xv97-c62v-4587

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJul 6, 2022

    Improper handling of email input

    • next-auth < 3.29.8 · fixed in 3.29.8
    • next-auth >= 4.0.0, < 4.9.0 · fixed in 4.9.0
    GHSA-pgjx-7f9g-9463CVE-2022-31127
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-pgjx-7f9g-9463 (CVE-2022-31127), severity high
What it is: Improper handling of email input
Affected packages:
- next-auth: affected versions < 3.29.8. Fixed in 3.29.8.
- next-auth: affected versions >= 4.0.0, < 4.9.0. Fixed in 4.9.0.
Details: https://github.com/advisories/GHSA-pgjx-7f9g-9463

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJun 21, 2022

    Improper Handling of `callbackUrl` parameter in next-auth

    • next-auth < 3.29.5 · fixed in 3.29.5
    • next-auth >= 4.0.0, < 4.5.0 · fixed in 4.5.0
    GHSA-g5fm-jp9v-2432CVE-2022-31093
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-g5fm-jp9v-2432 (CVE-2022-31093), severity high
What it is: Improper Handling of `callbackUrl` parameter in next-auth
Affected packages:
- next-auth: affected versions < 3.29.5. Fixed in 3.29.5.
- next-auth: affected versions >= 4.0.0, < 4.5.0. Fixed in 4.5.0.
Details: https://github.com/advisories/GHSA-g5fm-jp9v-2432

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumMay 24, 2022

    URL Redirection to Untrusted Site ('Open Redirect') in next-auth

    • next-auth < 3.29.3 · fixed in 3.29.3
    • next-auth >= 4.0.0, < 4.3.3 · fixed in 4.3.3
    GHSA-q2mx-j4x2-2h74CVE-2022-29214
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-q2mx-j4x2-2h74 (CVE-2022-29214), severity medium
What it is: URL Redirection to Untrusted Site ('Open Redirect') in next-auth
Affected packages:
- next-auth: affected versions < 3.29.3. Fixed in 3.29.3.
- next-auth: affected versions >= 4.0.0, < 4.3.3. Fixed in 4.3.3.
Details: https://github.com/advisories/GHSA-q2mx-j4x2-2h74

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumApr 22, 2022

    NextAuth.js default redirect callback vulnerable to open redirects

    • next-auth < 3.29.2 · fixed in 3.29.2
    • next-auth >= 4.0.0, < 4.3.2 · fixed in 4.3.2
    GHSA-f9wg-5f46-cjmwCVE-2022-24858
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-f9wg-5f46-cjmw (CVE-2022-24858), severity medium
What it is: NextAuth.js default redirect callback vulnerable to open redirects
Affected packages:
- next-auth: affected versions < 3.29.2. Fixed in 3.29.2.
- next-auth: affected versions >= 4.0.0, < 4.3.2. Fixed in 4.3.2.
Details: https://github.com/advisories/GHSA-f9wg-5f46-cjmw

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • lowFeb 11, 2021

    Token verification bug in next-auth

    • next-auth < 3.3.0 · fixed in 3.3.0
    GHSA-pg53-56cg-4m8qCVE-2021-21310
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-pg53-56cg-4m8q (CVE-2021-21310), severity low
What it is: Token verification bug in next-auth
Affected packages:
- next-auth: affected versions < 3.3.0. Fixed in 3.3.0.
Details: https://github.com/advisories/GHSA-pg53-56cg-4m8q

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

From the GitHub Advisory Database, refreshed hourly. Full history on GitHub.

Keeping Auth.js (NextAuth) patched

  • npm audit (or pnpm audit) lists known vulnerable packages in your lockfile, including ones pulled in by other packages.
  • Turn on Dependabot for your GitHub repo and it opens the upgrade for you when an advisory lands.
  • A patched framework doesn't cover your own setup: headers, cookies and HTTPS. The free check looks at those.