DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-7RQJ-J65F-68WH: GHSA-7RQJ-J65F-68WH: Account Takeover via Homoglyph Bypass in NextAuth.js Email Normalization

#security #cve #cybersecurity #ghsa

GHSA-7RQJ-J65F-68WH: Account Takeover via Homoglyph Bypass in NextAuth.js Email Normalization

Vulnerability ID: GHSA-7RQJ-J65F-68WH
CVSS Score: 8.1
Published: 2026-07-23

A security vulnerability in the email normalization logic of NextAuth.js and Auth.js allows remote attackers to bypass email validation constraints and achieve Account Takeover (ATO) through Unicode homoglyph smuggling. Under standard conditions, Unicode compatibility characters represent visually similar symbols that are normalized downstream to ASCII equivalents, facilitating structural validation bypasses. This issue specifically affects passwordless email authentication flows.

TL;DR

Unicode homoglyphs of the '@' symbol bypass structural email validation in NextAuth.js and are normalized downstream, enabling passwordless account takeovers.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-180 (Validate Before Canonicalize)
  • Attack Vector: Network (Remote, Unauthenticated)
  • CVSS v3.1 Score: 8.1 (High)
  • Exploit Status: Proof-of-Concept (PoC) Verified
  • CISA KEV Status: Not Listed
  • Impact: Account Takeover (ATO)

Affected Systems

  • NextAuth.js
  • Auth.js Core
  • next-auth
  • next-auth: < 4.24.15 (Fixed in: 4.24.15)
  • next-auth: 5.0.0-beta.0 to < 5.0.0-beta.32 (Fixed in: 5.0.0-beta.32)
  • @auth/core: < 0.41.3 (Fixed in: 0.41.3)

Code Analysis

Commit: 19d2feb

Fix: Unicode normalization in email normalizer for v4

@@ -39,7 +39,12 @@ export default async function signin(params: {
     const normalizer: (identifier: string) => string =
       provider.normalizeIdentifier ??
       ((identifier) => {
-        const trimmedEmail = identifier.trim()
+        // Apply Unicode NFKC normalization *before* validation. Without this, a
+        // character that is a homoglyph of `@` (e.g. U+FF20 FULLWIDTH COMMERCIAL
+        // AT) passes the single-`@` check below, but can later be canonicalized
+        // to an ASCII `@` by a downstream address parser, splitting the address
+        // into multiple recipients (CWE-180: validate before canonicalize).
+        const trimmedEmail = identifier.normalize("NFKC").trim()
Enter fullscreen mode Exit fullscreen mode

Commit: a63eee1

Fix: Unicode normalization in email normalizer for v5 Core

@@ -91,10 +91,16 @@ export async function sendToken(
   }
 }

-function defaultNormalizer(email?: string) {
+export function defaultNormalizer(email?: string) {
   if (!email) throw new Error("Missing email from request body.")

-  const trimmedEmail = email.toLowerCase().trim()
+  // Apply Unicode NFKC normalization *before* validation. Without this, a
+  // character that is a homoglyph of `@` (e.g. U+FF20 FULLWIDTH COMMERCIAL AT)
+  // passes the single-`@` check below, but can later be canonicalized to an
+  // ASCII `@` by a downstream address parser, splitting the address into
+  // multiple recipients. Normalizing first ensures any such homoglyph is
+  // turned into a real `@` and rejected by the checks below.
+  const trimmedEmail = email.normalize("NFKC").toLowerCase().trim()
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub: Official regression test cases verifying the homoglyph bypass using FULLWIDTH COMMERCIAL AT (U+FF20) and SMALL COMMERCIAL AT (U+FE6B).

Mitigation Strategies

  • Enforce NFKC Unicode normalization on all user inputs before invoking validation logic
  • Update dependency packages immediately to the designated fixed versions
  • Monitor authentication endpoints for requests containing non-ASCII domain-routing symbols

Remediation Steps:

  1. Identify deployments utilizing 'next-auth' or '@auth/core' with passwordless email providers
  2. For NextAuth.js v4, execute 'npm install next-auth@4.24.15' or update your package.json manually
  3. For NextAuth.js v5 beta, execute 'npm install next-auth@5.0.0-beta.32' or update your package.json
  4. For @auth/core deployments, update to version '0.41.3' or higher
  5. Audit any custom email normalizer callbacks ('normalizeIdentifier') to verify they execute '.normalize("NFKC")' prior to validation checks

References

Read the full report for GHSA-7RQJ-J65F-68WH on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)