AIKIDO-2025-10766
@auth/core is vulnerable to Improper Input Validation
57
Medium Risk
This Affects:
@auth/coreTL;DR
Affected versions of this package are vulnerable to improper email address parsing in the email sign-in flow. Due to a flaw in Nodemailer’s address parser (fixed in Nodemailer v7.0.7), a crafted input such as "e@attacker.com"@victim.com is misinterpreted, causing authentication emails to be sent to e@attacker.com (attacker-controlled) instead of the intended recipient <e@attacker.com>@victim.com. This issue allows an attacker to intercept login or verification links, leading to potential account takeover or unauthorized access.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@auth/core is vulnerable to Improper Input Validation in versions 0.0.1 - 0.41.0.
How to fix this
Upgrade the @auth/core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.