Auth.js Email Normalizer Bypass Flaw

A critical vulnerability has been identified in the email-based sign-in flow for Auth.js and NextAuth. The flaw stems from the default email normalizer, which validates addresses before performing necessary Unicode normalization, creating a bypass that can lead to unauthorized account access.

The issue affects @auth/core versions prior to 0.41.3 and next-auth versions prior to 4.24.15 and 5.0.0-beta.32. This vulnerability is significant because it permits an attacker to misroute passwordless sign-in links to an attacker-controlled mailbox, effectively bypassing authentication for victim accounts.

What's at Risk

Any organization utilizing the affected versions of Auth.js or NextAuth with the email or magic-link provider enabled is potentially at risk. The exposure is limited to deployments that rely on the built-in default identifier normalizer and utilize mail libraries or delivery services that perform Unicode normalization on recipient addresses.

Systems that are internet-facing and rely on standard passwordless authentication patterns are the primary targets for this class of vulnerability. If an application does not proactively reject or canonicalize non-ASCII addresses, it may be susceptible to account takeover attempts initiated by external actors.

How the Flaw Works

This vulnerability is a classic example of a validation-before-canonicalization flaw. In general security terms, this occurs when a system checks input for security constraints—such as ensuring an email address contains only one '@' symbol—before transforming that input into its standard, canonical form.

Attackers often exploit this by using homoglyph characters or non-standard Unicode representations. When the system performs its initial check, the input appears valid. However, once the downstream mail library processes the string, it applies normalization, which may convert the special characters into a standard '@' symbol. This results in the string having multiple separators, potentially causing the mail service to misinterpret the address and deliver the message to a recipient chosen by the attacker rather than the intended victim.

How to Protect Your Systems

• Upgrade @auth/core to version 0.41.3 or higher immediately.
• Upgrade next-auth to version 4.24.15 or 5.0.0-beta.32 to implement the required NFKC normalization fix.
• If you have implemented a custom normalizeIdentifier, ensure it performs Unicode normalization before any validation logic occurs.
• Review your sendVerificationRequest implementation to ensure that your mail delivery service is not inadvertently introducing normalization risks.
• Enforce standard security hardening practices, such as monitoring authentication logs for unusual patterns, to detect potential attempts to exploit sign-in flows.

The severity of this flaw highlights the importance of prompt patching when authentication mechanisms are compromised. Because this vulnerability allows for silent account takeover without requiring victim interaction, organizations should prioritize these updates to maintain the integrity of their user access controls.