Improper Neutralization Affecting @auth/core package, versions <0.41.1
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-AUTHCORE-13744119
- published29 Oct 2025
- disclosed29 Oct 2025
- creditJeya Seelan
Introduced: 29 Oct 2025
New CVE NOT AVAILABLE CWE-149 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade @auth/core to version 0.41.1 or higher.
Overview
@auth/core is an Authentication for the Web.
Affected versions of this package are vulnerable to Improper Neutralization in the email validation component. An attacker can intercept sensitive authentication emails by submitting a specially crafted email address that manipulates the parsing logic, causing messages to be sent to an unintended mailbox.