Incorrect Behavior Order: Validate Before Canonicalize Affecting next-auth package, versions >=4.10.3 <4.24.15>=5.0.0-beta.1 <5.0.0-beta.32
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-NEXTAUTH-18306876
- published25 Jul 2026
- disclosed23 Jul 2026
- creditkakashi-kx
Introduced: 23 Jul 2026
New CVE NOT AVAILABLE CWE-180 (opens in a new tab)How to fix?
Upgrade next-auth to version 4.24.15, 5.0.0-beta.32 or higher.
Overview
next-auth is an Authentication for Next.js
Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address containing Unicode homoglyphs that bypass validation, causing the passwordless sign-in link to be delivered to an attacker-controlled mailbox. This is only exploitable if the email/magic-link provider is enabled, the default identifier normalizer is used, and the mail delivery service applies Unicode normalization to recipient addresses.
Workaround
This vulnerability can be mitigated by supplying a custom normalizeIdentifier that normalizes the identifier using NFKC before validation, or by rejecting addresses with non-ASCII characters if internationalized email addresses are not required.