CRITICALnpm
GHSA-7rqj-j65f-68wh· CVE-2026-73420Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
Modified: 9/10/2026
package
npm/@auth/core
pkg:npm/%40auth/core
MEDIUM6.8npm
GHSA-x445-f3h2-j279· CVE-2026-73419Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Modified: 9/10/2026
HIGH7.5npm
GHSA-xmf8-cvqr-rfgj· CVE-2026-73418Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
Modified: 9/10/2026