# next-auth (npm) vulnerabilities 13 known vulnerabilities (3 critical, 4 high, 5 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.24.15 (Jul 20, 2026): no advisory affects it - Newest unaffected release: 4.24.15 (Jul 20, 2026), the latest release - Weekly downloads: 9.2M - Dependents: 7,320 - Releases: 500+ since 3.7.0 (Mar 2, 2021) - Registry: https://www.npmjs.com/package/next-auth - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-73421: 5.0.0-beta.0 to 5.0.0-beta.31 (5.0.0-beta.32 is outside it) - CVE-2026-73420: 4.10.3 to 4.24.14 (4.24.15 is outside it); 5.0.0-beta.1 to 5.0.0-beta.31 (5.0.0-beta.32 is outside it) - CVE-2026-73419: 0.0.0-experimental.1e239999 to 4.24.14 (4.24.15 is outside it); 5.0.0-beta.1 to 5.0.0-beta.31 (5.0.0-beta.32 is outside it) - CVE-2026-73418: 4.0.6 to 4.24.14 (4.24.15 is outside it); 5.0.0-beta.0 to 5.0.0-beta.31 (5.0.0-beta.32 is outside it) - CVE-2023-48309: 0.0.0-experimental.1e239999 to 4.24.4 (4.24.5 is outside it) - CVE-2023-27490: 0.0.0-experimental.1e239999 to 4.20.0 (4.20.1 is outside it) - CVE-2022-35924: 0.0.0-experimental.1e239999 to 3.29.9 (3.29.10 is outside it); 4.0.1 to 4.10.2 (4.10.3 is outside it) - CVE-2022-31186: 0.0.0-experimental.1e239999 to 3.29.8 (3.29.9 is outside it); 4.0.1 to 4.10.1 (4.10.2 is outside it) - CVE-2022-31127: 0.0.0-experimental.1e239999 to 3.29.7 (3.29.8 is outside it); 4.0.1 to 4.8.0 (4.9.0 is outside it) - CVE-2022-31093: 0.0.0-experimental.1e239999 to 3.29.4 (3.29.5 is outside it); 4.0.1 to 4.4.0 (4.5.0 is outside it) - CVE-2022-29214: 0.0.0-experimental.1e239999 to 3.29.1 (3.29.3 is outside it); 4.0.1 to 4.3.2 (4.3.3 is outside it) - CVE-2022-24858: 0.0.0-experimental.1e239999 to 3.29.1 (3.29.3 is outside it); 4.0.1 to 4.3.1 (4.3.2 is outside it) - CVE-2021-21310: 0.0.0-experimental.1e239999 to 0.0.0-pr.11562.ed0fce23 (3.7.0 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (13) ### [CVE-2026-73421](https://cve.now/CVE-2026-73421): NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error) - Severity: Critical 9.1 - Published: Aug 13, 2026 - Affected: from 5.0.0-beta.0, fixed in 5.0.0-beta.32. - Fixed in 5.0.0-beta.32 (released Jul 20, 2026, 24 days before disclosure). - The latest release, 4.24.15, is not affected. - 14% of next-auth downloads last week were affected versions (1.5M). ### [CVE-2026-73420](https://cve.now/CVE-2026-73420): NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass - Severity: Critical 9.1 - Published: Aug 13, 2026 - Affected: from 4.10.3, fixed in 4.24.15; from 5.0.0-beta.1, fixed in 5.0.0-beta.32. - Fixed in 4.24.15 (released Jul 20, 2026, 24 days before disclosure) and 5.0.0-beta.32 (released Jul 20, 2026, 24 days before disclosure). - The latest release, 4.24.15, is not affected. - 40% of next-auth downloads last week were affected versions (4.1M). ### [CVE-2026-73419](https://cve.now/CVE-2026-73419): NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them - Severity: Medium 6.8 - Published: Aug 12, 2026 - Affected: from 5.0.0-beta.1, fixed in 5.0.0-beta.32; fixed in 4.24.15. - Fixed in 4.24.15 (released Jul 20, 2026, 23 days before disclosure) and 5.0.0-beta.32 (released Jul 20, 2026, 23 days before disclosure). - The latest release, 4.24.15, is not affected. - 40% of next-auth downloads last week were affected versions (4.1M). ### [CVE-2026-73418](https://cve.now/CVE-2026-73418): NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers - Severity: High 7.5 - Published: Aug 12, 2026 - Affected: from 5.0.0-beta.0, fixed in 5.0.0-beta.32; from 4.0.6, fixed in 4.24.15. - Fixed in 4.24.15 (released Jul 20, 2026, 23 days before disclosure) and 5.0.0-beta.32 (released Jul 20, 2026, 23 days before disclosure). - The latest release, 4.24.15, is not affected. - 40% of next-auth downloads last week were affected versions (4.1M). ### [CVE-2023-48309](https://cve.now/CVE-2023-48309): next-auth vulnerable to possible user mocking that bypasses basic authentication - Severity: Medium 5.3 - Published: Nov 20, 2023 - Affected: fixed in 4.24.5. - Fixed in 4.24.5 (released Nov 10, 2023, 10 days before disclosure). - The latest release, 4.24.15, is not affected. - 1.1% of next-auth downloads last week were affected versions (109.3K). ### [CVE-2023-27490](https://cve.now/CVE-2023-27490): Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth - Severity: High 8.1 - Published: Mar 9, 2023 - Affected: fixed in 4.20.1. - Fixed in 4.20.1 (released Mar 2, 2023, 7 days before disclosure). - The latest release, 4.24.15, is not affected. - 0.3% of next-auth downloads last week were affected versions (28.5K). ### [CVE-2022-35924](https://cve.now/CVE-2022-35924): Verification requests (magic link) sent to unwanted emails - Severity: Critical 9.1 - Published: Aug 2, 2022 - Affected: from 4.0.0, fixed in 4.10.3; fixed in 3.29.10. - Fixed in 3.29.10 (released Aug 1, 2022, 1 day before disclosure) and 4.10.3 (released Aug 1, 2022, 1 day before disclosure). - The latest release, 4.24.15, is not affected. - <0.1% of next-auth downloads last week were affected versions (10.2K). ### [CVE-2022-31186](https://cve.now/CVE-2022-31186): Leakage of excessive information into log in next-auth - Severity: Low 3.3 - Published: Aug 1, 2022 - Affected: fixed in 3.29.9; from 4.0.0, fixed in 4.10.2. - Fixed in 3.29.9 (released Jul 25, 2022, 7 days before disclosure) and 4.10.2 (released Jul 21, 2022, 11 days before disclosure). - The latest release, 4.24.15, is not affected. - <0.1% of next-auth downloads last week were affected versions (10K). ### [CVE-2022-31127](https://cve.now/CVE-2022-31127): Improper handling of email input in next-auth - Severity: High 7.1 - Published: Jul 6, 2022 - Affected: fixed in 3.29.8; from 4.0.0, fixed in 4.9.0. - Fixed in 3.29.8 (released Jul 5, 2022, 1 day before disclosure) and 4.9.0 (released Jul 6, 2022, the day of disclosure). - The latest release, 4.24.15, is not affected. - <0.1% of next-auth downloads last week were affected versions (8.8K). ### [CVE-2022-31093](https://cve.now/CVE-2022-31093): Improper Handling of \`callbackUrl\` parameter in next-auth - Severity: High 7.5 - Published: Jun 27, 2022 - Affected: fixed in 3.29.5; from 4.0.0, fixed in 4.5.0. - Fixed in 3.29.5 (released Jun 20, 2022, 7 days before disclosure) and 4.5.0 (released Jun 12, 2022, 15 days before disclosure). - The latest release, 4.24.15, is not affected. - <0.1% of next-auth downloads last week were affected versions (8.4K). ### [CVE-2022-29214](https://cve.now/CVE-2022-29214): URL Redirection to Untrusted Site ('Open Redirect') in next-auth - Severity: Medium 6.1 - Published: May 20, 2022 - Affected: fixed in 3.29.3; from 4.0.0, fixed in 4.3.3. - Fixed in 3.29.3 (released Apr 26, 2022, 24 days before disclosure) and 4.3.3 (released Apr 20, 2022, 30 days before disclosure). - The latest release, 4.24.15, is not affected. - <0.1% of next-auth downloads last week were affected versions (7.5K). ### [CVE-2022-24858](https://cve.now/CVE-2022-24858): Default redirect callback vulnerable to open redirects - Severity: Medium 6.1 - Published: Apr 19, 2022 - Affected: fixed in 3.29.2; from 4.0.0, fixed in 4.3.2. - Fixed in 3.29.3 (released Apr 26, 2022, 7 days after disclosure, the advisory names 3.29.2, which was never published) and 4.3.2 (released Apr 14, 2022, 5 days before disclosure). - The latest release, 4.24.15, is not affected. - <0.1% of next-auth downloads last week were affected versions (7.4K). ### [CVE-2021-21310](https://cve.now/CVE-2021-21310): Token verification bug in next-auth - Severity: Medium 6.1 - Published: Feb 11, 2021 - Affected: fixed in 3.3.0. - Fixed in 3.7.0 (released Mar 2, 2021, 19 days after disclosure, the advisory names 3.3.0, which was never published). - The latest release, 4.24.15, is not affected. - <0.1% of next-auth downloads last week were affected versions (2.4K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/next-auth Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.