Critical
CVE-2026-73421
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 15
Reset filters
High
CVE-2026-73418
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
Critical
CVE-2026-73420
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
Medium
CVE-2026-73419
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Medium
ghsa-5jpx-9hw9-2fx4
NextAuthjs Email misdelivery Vulnerability
Medium
CVE-2023-48309
Possible user mocking that bypasses basic authentication
High
CVE-2023-27490
Missing proper state, nonce and PKCE checks for OAuth authentication
Medium
CVE-2022-39263
Upstash Adapter missing token verification
Low
CVE-2022-31186
next-auth before v4.10.2 and v3.29.9 leaks excessive information into log
Critical
CVE-2022-35924
NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails
High
CVE-2022-31127
Improper handling of email input
High
CVE-2022-31093
Improper Handling of `callbackUrl` parameter in next-auth
Medium
CVE-2022-29214
URL Redirection to Untrusted Site ('Open Redirect') in next-auth
Medium
CVE-2022-24858
NextAuth.js default redirect callback vulnerable to open redirects
Low
CVE-2021-21310
Token verification bug in next-auth
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.