Is next-auth 4.10 vulnerable?
npm · 4 releases from 4.10.0 to 4.10.3 · latest next-auth is 4.24.15 · checked 1 Nov 2026
Yes: 6 known advisories
Yes. next-auth 4.10.3, the last 4.10 release, is affected by 6 known security advisories (1 critical, 2 high, 3 medium), including CVE-2026-73420, CVE-2026-73418, CVE-2023-27490. 2 more affect earlier 4.10.x releases. Upgrade to 4.24.15 or later to fix all of them.
npm install next-auth@4.24.15Advisories affecting next-auth 4.10.3
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
- Affected
- >=5.0.0-beta.0 <5.0.0-beta.32 · >=4.0.6 <4.24.15
- Fixed in
- 4.24.15, 5.0.0-beta.32
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
- Affected
- >=4.10.3 <4.24.15 · >=5.0.0-beta.1 <5.0.0-beta.32
- Fixed in
- 4.24.15, 5.0.0-beta.32
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
- Affected
- >=5.0.0-beta.1 <5.0.0-beta.32 · <4.24.15
- Fixed in
- 4.24.15, 5.0.0-beta.32
NextAuthjs Email misdelivery Vulnerability
- Affected
- <4.24.12 · >=5.0.0-beta.0 <5.0.0-beta.30
- Fixed in
- 4.24.12, 5.0.0-beta.30
Possible user mocking that bypasses basic authentication
- Affected
- <4.24.5
- Fixed in
- 4.24.5
Missing proper state, nonce and PKCE checks for OAuth authentication
- Affected
- <4.20.1
- Fixed in
- 4.20.1
Fixed within 4.10.x, affecting earlier releases
next-auth before v4.10.2 and v3.29.9 leaks excessive information into log
- Affected
- <3.29.9 · >=4.0.0 <4.10.2
- Fixed in
- 3.29.9, 4.10.2
NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails
- Affected
- >=4.0.0 <4.10.3 · <3.29.10
- Fixed in
- 3.29.10, 4.10.3
Which of your client projects are still on next-auth 4.10?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact next-auth version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other next-auth versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.