Incorrect Behavior Order: Validate Before Canonicalize Affecting @auth/core package, versions >=0.1.0 <0.41.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-AUTHCORE-18306877
- published25 Jul 2026
- disclosed23 Jul 2026
- creditkakashi-kx
Introduced: 23 Jul 2026
New CVE NOT AVAILABLE CWE-180 (opens in a new tab)How to fix?
Upgrade @auth/core to version 0.41.3 or higher.
Overview
@auth/core is an Authentication for the Web.
Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address containing Unicode homoglyphs that bypass validation, causing the passwordless sign-in link to be delivered to an attacker-controlled mailbox. This is only exploitable if the email/magic-link provider is enabled, the default identifier normalizer is used, and the mail delivery service applies Unicode normalization to recipient addresses.
Workaround
This vulnerability can be mitigated by supplying a custom normalizeIdentifier that normalizes the identifier using NFKC before validation, or by rejecting addresses with non-ASCII characters if internationalized email addresses are not required.