Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @auth/core | npm | >= 0.1.0, < 0.41.3 | 0.41.3 |
| next-auth | npm | >= 4.10.3, < 4.24.15 | 4.24.15 |
| next-auth | npm | >= 5.0.0-beta.1, <= 5.0.0-beta.31 | 5.0.0-beta.32 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the email normalization logic of next-auth and @auth/core. The core issue is that the software validates email addresses for a single '@' symbol before it performs Unicode normalization. An attacker can craft an email address containing a Unicode character that looks like an '@' (a homoglyph) but is technically a different character. This address will pass the initial validation. However, when a downstream email service processes this address, it may apply Unicode normalization (like NFKC), which converts the homoglyph into a standard '@' symbol. This results in an email address with two '@' symbols, leading to the email being routed to an unintended, attacker-controlled recipient, and enabling account takeover.
The patches fix this by moving the Unicode normalization step to occur before the validation step. This ensures that any homoglyphs are converted to standard '@' symbols, and addresses with multiple '@' symbols are correctly rejected.
The vulnerable functions were identified by analyzing the provided commit patches. In next-auth, the logic is within an anonymous function inside the signin function in packages/next-auth/src/core/routes/signin.ts. In @auth/core, the vulnerable function is defaultNormalizer in packages/core/src/lib/actions/signin/send-token.ts.
signinpackages/next-auth/src/core/routes/signin.ts
defaultNormalizerpackages/core/src/lib/actions/signin/send-token.ts