@auth/core
npm · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers | @auth/corenext-auth | npm | High | Fix reported | |
| Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them | @auth/corenext-auth | npm | Medium | Fix reported | |
| Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass | @auth/corenext-auth | npm | Critical | Fix reported |