CVE-2026-73420: 
JavaScript vulnerability analysis and mitigation

CVE-2026-73420 is an authentication bypass vulnerability in NextAuth.js (next-auth and @auth/core) caused by incorrect validation order in the email/magic-link sign-in flow. The defaultNormalizer validates email addresses for a single ASCII @ sign before applying Unicode normalization, allowing an attacker to craft an address containing a Unicode homoglyph of @ (e.g., U+FF20 FULLWIDTH COMMERCIAL AT) that passes validation but is later canonicalized to a second @ by downstream mail libraries, misrouting the passwordless sign-in link to an attacker-controlled mailbox. Affected versions include next-auth < 4.24.15, next-auth >= 5.0.0-beta.1 through <= 5.0.0-beta.31, and @auth/core >= 0.1.0 < 0.41.3. The vulnerability was published on July 20, 2026, and reported by researcher @kakashi-kx. It carries a CVSS v4.0 base score of 9.1 (Critical) (GitHub Advisory, Feedly).

The root cause is CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize). The defaultNormalizer function in the email sign-in flow checks that the input contains exactly one ASCII @ character before applying any Unicode normalization. An attacker can submit an address such as attacker@evil.com＠victim.company.com — where ＠ is U+FF20 FULLWIDTH COMMERCIAL AT — which passes the single-@ check because only one ASCII @ is present. When a downstream SMTPUTF8-capable mail library or delivery service applies NFKC/NFKD normalization, the fullwidth character is canonicalized to a standard @, resulting in two @ separators and causing the magic link to be delivered to the attacker-controlled address. The fix, applied in commits 19d2feb and a63eee1, prepends String.prototype.normalize("NFKC") to the normalization pipeline so homoglyph characters are collapsed and rejected by the existing atCount check before any mail is sent (GitHub Advisory, Patch Commit).

Successful exploitation results in full account takeover without any victim interaction. An attacker who knows a victim's email address can initiate the passwordless sign-in flow, receive the magic link in their own mailbox due to the misrouted delivery, and authenticate as the victim — gaining complete access to the victim's account and all associated data and privileges. The confidentiality and integrity of affected accounts are fully compromised, and the attack can be performed remotely by any unauthenticated party, making it scalable across all users of a vulnerable application (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation at the time of publication (Feedly). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no victim interaction, and only knowledge of the target's email address, making it conceptually straightforward to exploit against applications that use the built-in normalizer with a Unicode-normalizing mail backend.

1. Reconnaissance: Identify a target application using NextAuth.js with the email/magic-link (passwordless) provider enabled and running an affected version (next-auth < 4.24.15 or @auth/core < 0.41.3).
2. Obtain victim email: Determine the victim's registered email address (e.g., victim@company.com) through OSINT, data leaks, or application enumeration.
3. Craft malicious email address: Construct an address embedding a Unicode homoglyph of @ between an attacker-controlled address and the victim's domain, e.g., attacker@evil.com＠victim.company.com (where ＠ is U+FF20 FULLWIDTH COMMERCIAL AT).
4. Submit sign-in request: POST the crafted address to the application's email sign-in endpoint (e.g., /api/auth/signin/email). The defaultNormalizer sees only one ASCII @ and passes validation.
5. Receive misrouted magic link: The downstream mail library applies NFKC normalization, converting ＠ to @, yielding two @ separators. The mail service interprets the first address (attacker@evil.com) as the recipient and delivers the magic link there.
6. Authenticate as victim: The attacker clicks the received magic link and is signed into the application as the victim, achieving full account takeover (GitHub Advisory, Patch Commit).

• Logs: Authentication logs showing magic-link sign-in requests where the submitted email address contains non-ASCII characters (Unicode codepoints outside U+0000–U+007F), particularly in the local part or around the @ separator; look for addresses containing U+FF20 (＠) or U+FE6B (﹫).
• Logs: Sign-in events for a user account originating from an IP address or session that does not match the victim's typical access patterns, immediately following a magic-link issuance.
• Network: Outbound SMTP delivery to an address that differs from the registered account email after Unicode normalization is applied — e.g., the envelope recipient resolving to a different domain than the stored user record.
• Application: Magic-link verification token consumption from a geographic location or device inconsistent with the account owner, especially shortly after an unusual sign-in request was logged.

Upgrade to the patched versions: next-auth 4.24.15, next-auth 5.0.0-beta.32, or @auth/core 0.41.3. No application code changes are required after upgrading — the fix is entirely within the library's defaultNormalizer. If an immediate upgrade is not possible, supply a custom normalizeIdentifier on the email provider that calls identifier.normalize("NFKC") before any validation and rejects addresses that do not contain exactly one @ after normalization. Alternatively, reject any address whose local part or domain contains non-ASCII characters if your user base does not require internationalized email support (GitHub Advisory, next-auth Release, @auth/core Release).

The vulnerability was responsibly disclosed by researcher @kakashi-kx and acknowledged by the NextAuth.js maintainers in the official GitHub Security Advisory (GitHub Advisory). The advisory was published alongside patched releases on July 20, 2026. No significant broader media coverage or notable social media commentary has been identified at this time.