Vulnerability-Lookup

CVE-2026-73420 (GCVE-0-2026-73420)

Vulnerability from cvelistv5 – Published: 2026-08-13 22:04 – Updated: 2026-08-14 15:06

Title

NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Summary

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer's single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim's email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:05 UTC

CWE

CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/nextauthjs/next-auth/security/…	x_refsource_CONFIRM
https://github.com/nextauthjs/next-auth/commit/19…	x_refsource_MISC
https://github.com/nextauthjs/next-auth/commit/a6…	x_refsource_MISC
https://github.com/nextauthjs/next-auth/releases/…	x_refsource_MISC
https://github.com/nextauthjs/next-auth/releases/…	x_refsource_MISC
https://github.com/nextauthjs/next-auth/releases/…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version	CPE status
nextauthjs	next-auth	Affected: < 4.24.15 Affected: >= 5.0.0-beta.4, < 5.0.0-beta.32	guessed
@auth	core	Affected: >= 0.1.0, < 0.41.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73420",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:05:10.354847Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:06:00.594Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "next-auth",
          "vendor": "nextauthjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.24.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.4, \u003c 5.0.0-beta.32"
            }
          ]
        },
        {
          "product": "core",
          "vendor": "@auth",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.1.0, \u003c 0.41.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer\u0027s single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim\u0027s email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-180",
              "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T22:04:15.414Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"
        }
      ],
      "source": {
        "advisory": "GHSA-7rqj-j65f-68wh",
        "discovery": "UNKNOWN"
      },
      "title": "NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73420",
    "datePublished": "2026-08-13T22:04:15.414Z",
    "dateReserved": "2026-08-12T14:32:11.795Z",
    "dateUpdated": "2026-08-14T15:06:00.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73420",
      "date": "2026-10-15",
      "epss": "0.00725",
      "percentile": "0.53101"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "next-auth",
                "vendor": "nextauthjs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.24.15"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 5.0.0-beta.4, \u003c 5.0.0-beta.32"
                  }
                ]
              },
              {
                "product": "core",
                "vendor": "@auth",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 0.1.0, \u003c 0.41.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer\u0027s single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim\u0027s email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32."
          }
        ],
        "id": "CVE-2026-73420",
        "lastModified": "2026-09-18T20:05:53.723",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-73420",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:05:10.354847Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-13T22:17:26.297",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-180"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-73420",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-14T15:05:10.354847Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-14T15:05:54.071Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "next-auth",
              "vendor": "nextauthjs",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.24.15"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 5.0.0-beta.4, \u003c 5.0.0-beta.32"
                }
              ]
            },
            {
              "product": "core",
              "vendor": "@auth",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 0.1.0, \u003c 0.41.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer\u0027s single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim\u0027s email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-180",
                  "description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-13T22:04:15.414Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh"
            },
            {
              "name": "https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94"
            },
            {
              "name": "https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0"
            },
            {
              "name": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3"
            },
            {
              "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15"
            },
            {
              "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"
            }
          ],
          "source": {
            "advisory": "GHSA-7rqj-j65f-68wh",
            "discovery": "UNKNOWN"
          },
          "title": "NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-73420",
        "datePublished": "2026-08-13T22:04:15.414Z",
        "dateReserved": "2026-08-12T14:32:11.795Z",
        "dateUpdated": "2026-08-14T15:06:00.594Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CLEANSTART-2026-WJ12510 (GHSA-FRVP-7C67-39W9)

Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in langfuse-worker 3.217.0-r1

Details

Package langfuse-worker version 3.217.0-r1 fixes 29 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, ghsa-55q2-fjhq-7xh7, ghsa-c2j3-45gr-mqc4, CVE-2026-69192...

References

URL

Type

https://github.com/langfuse/langfuse

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "langfuse-worker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.217.0-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.217.0-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package langfuse-worker version 3.217.0-r1 fixes 29 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, ghsa-55q2-fjhq-7xh7, ghsa-c2j3-45gr-mqc4, CVE-2026-69192...",
  "id": "CLEANSTART-2026-WJ12510",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langfuse/langfuse"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in langfuse-worker 3.217.0-r1",
  "upstream": [
    "ghsa-frvp-7c67-39w9",
    "ghsa-p63j-vcc4-9vmv",
    "ghsa-55q2-fjhq-7xh7",
    "ghsa-c2j3-45gr-mqc4",
    "CVE-2026-69192",
    "CVE-2026-54272",
    "CVE-2026-69198",
    "ghsa-5p4m-2wfm-xmqj",
    "CVE-2026-50159",
    "CVE-2026-71436",
    "CVE-2026-71437",
    "CVE-2026-71439",
    "CVE-2026-71438",
    "CVE-2026-67213",
    "CVE-2026-67214",
    "ghsa-7rqj-j65f-68wh",
    "ghsa-xmf8-cvqr-rfgj",
    "ghsa-x445-f3h2-j279",
    "CVE-2026-73419",
    "CVE-2026-73418",
    "CVE-2026-73420",
    "ghsa-r28c-9q8g-f849",
    "CVE-2026-69153",
    "ghsa-f88m-g3jw-g9cj",
    "CVE-2026-13697",
    "CVE-2026-14643",
    "CVE-2026-15157",
    "CVE-2026-16728",
    "CVE-2026-16729"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

CLEANSTART-2026-YJ84605 (GHSA-FRVP-7C67-39W9)

Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in langfuse-worker 3.215.0-r1

Details

Package langfuse-worker version 3.215.0-r1 fixes 28 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, ghsa-55q2-fjhq-7xh7, ghsa-c2j3-45gr-mqc4, CVE-2026-69192...

References

URL

Type

https://github.com/langfuse/langfuse

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "langfuse-worker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.215.0-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.215.0-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package langfuse-worker version 3.215.0-r1 fixes 28 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, ghsa-55q2-fjhq-7xh7, ghsa-c2j3-45gr-mqc4, CVE-2026-69192...",
  "id": "CLEANSTART-2026-YJ84605",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langfuse/langfuse"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in langfuse-worker 3.215.0-r1",
  "upstream": [
    "ghsa-frvp-7c67-39w9",
    "ghsa-p63j-vcc4-9vmv",
    "ghsa-55q2-fjhq-7xh7",
    "ghsa-c2j3-45gr-mqc4",
    "CVE-2026-69192",
    "CVE-2026-54272",
    "CVE-2026-69198",
    "ghsa-5p4m-2wfm-xmqj",
    "CVE-2026-50159",
    "CVE-2026-71436",
    "CVE-2026-71437",
    "CVE-2026-71439",
    "CVE-2026-71438",
    "CVE-2026-67213",
    "CVE-2026-67214",
    "ghsa-7rqj-j65f-68wh",
    "ghsa-xmf8-cvqr-rfgj",
    "ghsa-x445-f3h2-j279",
    "CVE-2026-73419",
    "CVE-2026-73418",
    "CVE-2026-73420",
    "CVE-2026-69153",
    "ghsa-f88m-g3jw-g9cj",
    "CVE-2026-13697",
    "CVE-2026-14643",
    "CVE-2026-15157",
    "CVE-2026-16728",
    "CVE-2026-16729"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

CLEANSTART-2026-YK54542 (GHSA-FRVP-7C67-39W9)

Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in langfuse-worker 3.213.0-r1

Details

Package langfuse-worker version 3.213.0-r1 fixes 30 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, ghsa-55q2-fjhq-7xh7, ghsa-c2j3-45gr-mqc4, CVE-2026-69192...

References

URL

Type

https://github.com/langfuse/langfuse

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "langfuse-worker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.213.0-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.213.0-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package langfuse-worker version 3.213.0-r1 fixes 30 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, ghsa-55q2-fjhq-7xh7, ghsa-c2j3-45gr-mqc4, CVE-2026-69192...",
  "id": "CLEANSTART-2026-YK54542",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langfuse/langfuse"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in langfuse-worker 3.213.0-r1",
  "upstream": [
    "ghsa-frvp-7c67-39w9",
    "ghsa-p63j-vcc4-9vmv",
    "ghsa-55q2-fjhq-7xh7",
    "ghsa-c2j3-45gr-mqc4",
    "CVE-2026-69192",
    "CVE-2026-54272",
    "CVE-2026-69198",
    "ghsa-5p4m-2wfm-xmqj",
    "CVE-2026-50159",
    "CVE-2026-71436",
    "CVE-2026-71437",
    "CVE-2026-71439",
    "CVE-2026-71438",
    "CVE-2026-67213",
    "CVE-2026-67214",
    "ghsa-7rqj-j65f-68wh",
    "ghsa-xmf8-cvqr-rfgj",
    "ghsa-x445-f3h2-j279",
    "CVE-2026-73419",
    "CVE-2026-73418",
    "CVE-2026-73420",
    "ghsa-p6gq-j5cr-w38f",
    "ghsa-r28c-9q8g-f849",
    "CVE-2026-69153",
    "ghsa-f88m-g3jw-g9cj",
    "CVE-2026-13697",
    "CVE-2026-14643",
    "CVE-2026-15157",
    "CVE-2026-16728",
    "CVE-2026-16729"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

CLEANSTART-2026-YR55628 (GHSA-FRVP-7C67-39W9)

Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in langfuse-worker 3.194.1-r1

Details

Package langfuse-worker version 3.194.1-r1 fixes 30 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, CVE-2026-50272, ghsa-55q2-fjhq-7xh7, CVE-2026-65898...

References

URL

Type

https://github.com/langfuse/langfuse

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "langfuse-worker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.194.1-r1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.194.1-r1"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package langfuse-worker version 3.194.1-r1 fixes 30 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, CVE-2026-50272, ghsa-55q2-fjhq-7xh7, CVE-2026-65898...",
  "id": "CLEANSTART-2026-YR55628",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langfuse/langfuse"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in langfuse-worker 3.194.1-r1",
  "upstream": [
    "ghsa-frvp-7c67-39w9",
    "ghsa-p63j-vcc4-9vmv",
    "CVE-2026-50272",
    "ghsa-55q2-fjhq-7xh7",
    "CVE-2026-65898",
    "ghsa-c2j3-45gr-mqc4",
    "CVE-2026-69192",
    "CVE-2026-54272",
    "CVE-2026-69198",
    "CVE-2026-50159",
    "CVE-2026-71436",
    "CVE-2026-71437",
    "CVE-2026-71439",
    "CVE-2026-71438",
    "CVE-2026-67214",
    "CVE-2026-67213",
    "ghsa-7rqj-j65f-68wh",
    "ghsa-xmf8-cvqr-rfgj",
    "ghsa-x445-f3h2-j279",
    "CVE-2026-73419",
    "CVE-2026-73418",
    "CVE-2026-73420",
    "ghsa-r28c-9q8g-f849",
    "CVE-2026-69153",
    "ghsa-f88m-g3jw-g9cj",
    "CVE-2026-13697",
    "CVE-2026-14643",
    "CVE-2026-15157",
    "CVE-2026-16728",
    "CVE-2026-16729"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

FKIE_CVE-2026-73420

Vulnerability from fkie_nvd - Published: 2026-08-13 22:17 - Updated: 2026-09-18 20:05

Severity

9.1 (Critical) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94
	security-advisories@github.com	https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0
	security-advisories@github.com	https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3
	security-advisories@github.com	https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15
	security-advisories@github.com	https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32
	security-advisories@github.com	https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "next-auth",
          "vendor": "nextauthjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.24.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.4, \u003c 5.0.0-beta.32"
            }
          ]
        },
        {
          "product": "core",
          "vendor": "@auth",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.1.0, \u003c 0.41.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as U+FF20 FULLWIDTH COMMERCIAL AT that is not ASCII at-sign but canonicalizes to an ASCII at-sign under NFKC or NFKD normalization. The address passes the normalizer\u0027s single-at-sign check, but a downstream sendVerificationRequest mail library or delivery service that normalizes the address can then see two at-sign separators and deliver the passwordless sign-in link to an attacker-controlled recipient. Applications are affected when the email provider uses the built-in normalizer rather than a custom normalizeIdentifier and the downstream sender applies Unicode normalization. An attacker who knows a victim\u0027s email address can request the misrouted magic link and sign in as the victim without victim interaction. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32."
    }
  ],
  "id": "CVE-2026-73420",
  "lastModified": "2026-09-18T20:05:53.723",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73420",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-14T15:05:10.354847Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-13T22:17:26.297",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-180"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-7RQJ-J65F-68WH

Vulnerability from github – Published: 2026-07-23 14:40 – Updated: 2026-08-12 20:27

Summary

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Details

Summary

The default email-address normalizer used by the email/magic-link sign-in flow validates the address before applying Unicode normalization. An address can contain a Unicode character that is not an ASCII @ (U+0040) but canonicalizes to one under NFKC/NFKD normalization (the normalization commonly applied by mail libraries and services for internationalized email). Such an address passes the normalizer's single-@ check, but a downstream mail library that normalizes the string then sees two @ separators and may deliver the passwordless sign-in link to a different recipient than intended. This is an instance of validating before canonicalizing.

Am I affected?

You may be affected if all of the following hold:

You use next-auth >= 4.0.0, < 4.24.14, or @auth/core >= 0.1.0, < 0.41.3.
You have the email / magic-link (passwordless) provider enabled.
You rely on the built-in default identifier normalizer (you have not supplied your own normalizeIdentifier).
Your sendVerificationRequest implementation uses a mail library or delivery service that applies Unicode normalization to recipient addresses (most internationalized-email/SMTPUTF8-capable senders do).

You are not affected if you do not use the email provider, or if your normalizer/mailer rejects or canonicalizes non-ASCII addresses before they are validated.

Impact

Account takeover: an attacker who knows a victim's email address can request a magic link that is delivered to an attacker-controlled mailbox, then use it to sign in as the victim.
No victim interaction is required to misroute the link; the attacker initiates the flow.

Patched version

The fix applies Unicode (NFKC) normalization before the address is validated, so homoglyph separators are collapsed and rejected up front. Upgrade to the first release containing this fix (pending; this advisory will be updated with the exact patched version before publication). No application code changes are required after upgrading.

Workarounds

If you cannot upgrade immediately:

Supply a custom normalizeIdentifier on the email provider that calls identifier.normalize("NFKC") (and lower-cases/trims) before any validation, and rejects addresses that do not contain exactly one @ after normalization.
Or reject any address whose local part or domain contains non-ASCII characters, if your user base does not require internationalized email addresses.

Credit

Reported by @kakashi-kx. Thank you for the responsible disclosure.

Severity

9.1 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@auth/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.0"
            },
            {
              "fixed": "0.41.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "next-auth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.10.3"
            },
            {
              "fixed": "4.24.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.0-beta.31"
      },
      "package": {
        "ecosystem": "npm",
        "name": "next-auth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-beta.1"
            },
            {
              "fixed": "5.0.0-beta.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73420"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-180"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-23T14:40:15Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nThe default email-address normalizer used by the email/magic-link sign-in flow validates the address **before** applying Unicode normalization. An address can contain a Unicode character that is not an ASCII `@` (U+0040) but canonicalizes to one under NFKC/NFKD normalization (the normalization commonly applied by mail libraries and services for internationalized email). Such an address passes the normalizer\u0027s single-`@` check, but a downstream mail library that normalizes the string then sees two `@` separators and may deliver the passwordless sign-in link to a different recipient than intended. This is an instance of validating before canonicalizing.\n\n## Am I affected?\n\nYou may be affected if **all** of the following hold:\n\n- You use `next-auth` `\u003e= 4.0.0, \u003c 4.24.14`, or `@auth/core` `\u003e= 0.1.0, \u003c 0.41.3`.\n- You have the email / magic-link (passwordless) provider enabled.\n- You rely on the built-in default identifier normalizer (you have not supplied your own `normalizeIdentifier`).\n- Your `sendVerificationRequest` implementation uses a mail library or delivery service that applies Unicode normalization to recipient addresses (most internationalized-email/SMTPUTF8-capable senders do).\n\nYou are **not** affected if you do not use the email provider, or if your normalizer/mailer rejects or canonicalizes non-ASCII addresses before they are validated.\n\n## Impact\n\n- Account takeover: an attacker who knows a victim\u0027s email address can request a magic link that is delivered to an attacker-controlled mailbox, then use it to sign in as the victim.\n- No victim interaction is required to misroute the link; the attacker initiates the flow.\n\n## Patched version\n\nThe fix applies Unicode (NFKC) normalization before the address is validated, so homoglyph separators are collapsed and rejected up front. Upgrade to the first release containing this fix (pending; this advisory will be updated with the exact patched version before publication). No application code changes are required after upgrading.\n\n## Workarounds\n\nIf you cannot upgrade immediately:\n\n- Supply a custom `normalizeIdentifier` on the email provider that calls `identifier.normalize(\"NFKC\")` (and lower-cases/trims) **before** any validation, and rejects addresses that do not contain exactly one `@` after normalization.\n- Or reject any address whose local part or domain contains non-ASCII characters, if your user base does not require internationalized email addresses.\n\n## Credit\n\nReported by @kakashi-kx. Thank you for the responsible disclosure.",
  "id": "GHSA-7rqj-j65f-68wh",
  "modified": "2026-08-12T20:27:03Z",
  "published": "2026-07-23T14:40:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-7rqj-j65f-68wh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nextauthjs/next-auth/commit/19d2feb24359fa8c79418907fc68d9ec8152ca94"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nextauthjs/next-auth/commit/a63eee12a1a20cb35209e44195b097868517b9a0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nextauthjs/next-auth"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-73420 (GCVE-0-2026-73420)

CLEANSTART-2026-WJ12510 (GHSA-FRVP-7C67-39W9)

CLEANSTART-2026-YJ84605 (GHSA-FRVP-7C67-39W9)

CLEANSTART-2026-YK54542 (GHSA-FRVP-7C67-39W9)

CLEANSTART-2026-YR55628 (GHSA-FRVP-7C67-39W9)

FKIE_CVE-2026-73420

GHSA-7RQJ-J65F-68WH

Summary

Am I affected?

Impact

Patched version

Workarounds

Credit

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour