Auth.js Vulnerability: Homoglyph @ Bypass in Email Normalizer

Executive Summary

A critical vulnerability with a CVSS score of 9.1 was discovered in Auth.js, affecting the email/magic-link sign-in flow. The flaw allows an attacker to bypass email validation by exploiting Unicode normalization, potentially leading to account takeover. This vulnerability affects `next-auth` versions >= 4.0.0, < 4.24.14 and `@auth/core` versions >= 0.1.0, < 0.41.3.

Technical Analysis

The vulnerability class is an instance of validating before canonicalizing. The default email-address normalizer validates the address before applying Unicode normalization. An attacker can craft an email address containing a Unicode character that is not an ASCII `@` (U+0040) but canonicalizes to one under NFKC/NFKD normalization. This allows the address to pass the normalizer's single-`@` check. A downstream mail library that normalizes the string may then see two `@` separators and deliver the passwordless sign-in link to a different recipient than intended.

How It Gets Exploited

An attacker who knows a victim's email address can request a magic link. By crafting a specially designed email address that contains a Unicode character mimicking the `@` symbol, the attacker can cause the magic link to be delivered to an attacker-controlled mailbox. The attacker then uses the link to sign in as the victim. No victim interaction is required.

Impact Assessment

The impact is severe, with a CVSS score of 9.1. Successful exploitation leads to account takeover. Affected products include `next-auth` versions >= 4.0.0, < 4.24.14 and `@auth/core` versions >= 0.1.0, < 0.41.3. The vulnerability is mitigated if a custom `normalizeIdentifier` is supplied or if the mail library rejects non-ASCII addresses before validation.

Recommended Actions

To mitigate this vulnerability, update `next-auth` to version 4.24.14 or later, or `@auth/core` to version 0.41.3 or later. If immediate updates are not possible, implement a custom `normalizeIdentifier` that applies Unicode (NFKC) normalization before validation and rejects addresses that do not contain exactly one `@` after normalization. Alternatively, reject any address with non-ASCII characters in the local part or domain if internationalized email addresses are not required.

Sources

- GitHub Security Advisories: GHSA-7rqj-j65f-68wh