@Auth

3 CVEs in 1 @Auth product, including Core. Newest: CVE-2026-73420 (2026-08-13). Severity, EPSS and public exploits for each.

@Auth products with known CVEs

ProductCVEs
Core3
@Auth CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-734202026-08-13NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email an…
CVE-2026-73419Medium6.82026-08-12NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF che…
CVE-2026-73418High7.52026-08-12NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next…