CVE-2026-73419: Auth.js OAuth provider-confusion in state/nonce/PKCE cookies

CVE-2026-73419 · Severity: medium · CVSS 6.8 · Published 2026-08-12

Auth.js is a widely-used authentication library used to add login features to web applications. The library stores security tokens (state, nonce, and PKCE verification codes) in cookies that are not tied to specific OAuth providers. This allows an attacker to trick an authentication system into linking their account to a victim's legitimate user account, enabling persistent unauthorized access. The vulnerability only affects systems supporting multiple login providers with account linking while logged in.

Technologies: @auth/core (npm), next-auth (npm). Vendors: npm.

Quick answers

Is CVE-2026-73419 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73419 being exploited in the wild.
How severe is CVE-2026-73419?
Medium severity, with a CVSS score of 6.8, published 12 August 2026.
Which products and versions are affected?
@auth/core (npm) SEMVER:introduced=0,fixed=0.41.3; next-auth (npm) SEMVER:introduced=5.0.0-beta.1,fixed=5.0.0-beta.32.
Is there a fix for CVE-2026-73419?
Yes. @auth/core (npm): upgrade to 0.41.3 or later; next-auth (npm): upgrade to 5.0.0-beta.32 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-73419?
Check whether you run @auth/core (npm) or next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @auth/core (npm): upgrade to 0.41.3 or later
    npm install @auth/core@0.41.3
  • next-auth (npm): upgrade to 5.0.0-beta.32 or later
    npm install next-auth@5.0.0-beta.32

Technical details

Auth.js stores OAuth/OIDC anti-CSRF checks (state, nonce, and PKCE verifier) in global cookies without binding them to the originating provider. During callback processing, a check value created for one provider can be consumed by a different provider because the stored cookie is not verified against the callback provider's identity (provider ID, issuer, client ID, or redirect URI). The attack is a provider-confusion/mix-up attack requiring: (1) multiple OAuth/OIDC providers configured, (2) account linking allowed while logged in, (3) at least one provider's authorization request observable by an attacker, and (4) at least one target provider not enforcing PKCE. An attacker can then link their account at a target provider to a victim's user by intercepting and replaying checks. The fix binds OAuth check cookies to the specific provider/authorization flow that created them.

Affected products

  • Auth.js @auth/core <= 0.41.2
  • Auth.js next-auth <= 4.24.14 and >= 5.0.0-beta.1, <= 5.0.0-beta.31

Identifiers

  • CVE-2026-73419
  • GHSA-x445-f3h2-j279

Timeline

  • 2026-07-23: disclosed
  • 2026-07-23: patched: @auth/core 0.41.3, next-auth 4.24.15 and 5.0.0-beta.32

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.