Skip to content
Fencer Vulns
medium 6.8

CVE-2026-73419 json

NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

published 2026-07-23 3 mo ago modified 2026-09-10 1 mo ago also EUVD-2026-57601 , GHSA-x445-f3h2-j279

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 16%
public exploits
0
none known

Summary

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider's authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker's target-provider account to the victim's Auth.js user. The linked provider grants the attacker persistent sign-in to the victim's account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.

Patch / fix

  • npm @auth/core 0.41.3
  • npm next-auth 4.24.15, 5.0.0-beta.32
  • nextauth.js next-auth 4.24.15, 5.0.0-beta.32
  • nextauth.js @auth/core 0.41.3

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
GitHub 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm @auth/core
<0.41.3
0.41.3
npm next-auth
>=5.0.0-beta.1, <5.0.0-beta.32
<4.24.15
5.0.0-beta.32
4.24.15

Affected products

  • nextauthjs next-auth
  • @auth core

Classification

Weakness
  • CWE-345 Insufficient Verification of Data Authenticity
  • CWE-346 Origin Validation Error
  • CWE-940 Improper Verification of Source of a Communication Channel

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.