CVE-2026-73419 NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Attackers can link their account to a victim's profile in multi-provider NextAuth.js apps, gaining persistent access to the victim's account.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-73419?
CVE-2026-73419 is a medium-severity authentication bypass vulnerability in @auth core, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider because the stored cookie is not verified against the callback provider's identity, including the provider ID, issuer, client ID, or redirect URI. In a multi-provider application that permits account linking while logged in, when one provider's authorization request is observable and a target provider callback can be satisfied without a PKCE verifier, an attacker can lure a victim into starting a legitimate same-origin flow and link the attacker's target-provider account to the victim's Auth.js user. The linked provider grants the attacker persistent sign-in to the victim's account, while cross-site request forgery alone is insufficient. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
Which versions are affected by CVE-2026-73419?
6 open source packages ship an affected version, including @auth/core and next-auth.
| Package | Affected | Fixed in |
|---|---|---|
@auth/core npm | All versions | 0.41.3 |
@auth/core npm | All versions | 0.41.3 |
next-auth npm | All versions | 4.24.15 |
next-auth npm | All versions | 4.24.15 |
next-auth npm | From 5.0.0-beta.1 | 5.0.0-beta.32 |
next-auth npm | From 5.0.0-beta.1 | 5.0.0-beta.32 |
How do I fix CVE-2026-73419?
Upgrade @auth/core to 0.41.3 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-73419 being exploited?
There is no known exploitation of CVE-2026-73419 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-HJ83512, CLEANSTART-2026-JW21689, ECHO-4bf4-a83a-db7c, GHSA-x445-f3h2-j279, MINI-97pm-49wj-qr65.