AIKIDO-2025-10766
@auth/core is vulnerable to Improper Input Validation
57
Medium Risk
This Affects:
@auth/coreTL;DR
Affected versions of this package are vulnerable to improper email address parsing in the email sign-in flow. Due to a flaw in Nodemailer’s address parser (fixed in Nodemailer v7.0.7), a crafted input such as "e@attacker.com"@victim.com is misinterpreted, causing authentication emails to be sent to e@attacker.com (attacker-controlled) instead of the intended recipient <e@attacker.com>@victim.com. This issue allows an attacker to intercept login or verification links, leading to potential account takeover or unauthorized access.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@auth/core is vulnerable to Improper Input Validation in versions 0.0.1 - 0.41.0.
How to fix this
Upgrade the @auth/core library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant