Unicode homoglyph email bypass in NextAuth.js magic-link flow (CVE-2026-73420)

The default email normalizer in NextAuth.js validates an address before applying Unicode normalization, allowing an address containing a homoglyph at-sign character (e.g., U+FF20 FULLWIDTH COMMERCIAL AT) to pass the single-at-sign check. A downstream mail library or delivery service that applies Unicode normalization can then see two at-sign separators and route the passwordless sign-in link to an attacker-controlled recipient. An attacker who knows a victim's email address can trigger this misrouting and authenticate as the victim without any victim interaction. Affected versions: - @auth/core < 0.41.3 We recommend updating to: @auth/core 0.41.3. CVSS 9.1 · our assessment: act_now Reference: https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3 Details: https://vuln.today/cve/CVE-2026-73420