Tag
#Auth.js
Auth.js Vulnerability: Homoglyph @ Bypass in Email Normalizer
A critical vulnerability in Auth.js allows an attacker to bypass email validation, potentially leading to account takeover. The flaw affects versions of `next-auth` and `@auth/core` when using the email/magic-link sign-in flow with the default identifier normalizer. Immediate action is required to prevent exploitation.
Auth.js Configuration Error Leads to Silent Fail-Open in Existence-Based Auth Checks
A critical vulnerability in Auth.js (next-auth) version 5 allows misconfigured applications to fail open, granting unauthorized access to all users when the auth layer encounters a server-side error. This issue arises from existence-based auth checks evaluating to true for every request, including unauthenticated ones, when the auth object is populated with an error. The vulnerability has a CVSS score of 9.1 and is classified under CWE-636 (Not Failing Securely) and CWE-285 (Improper Authorization).