{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/unicode-normalization/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["next-auth (\u003e= 4.0.0, \u003c 4.24.14)","next-auth (\u003e= 4.10.3, \u003c 4.24.15)","next-auth (\u003e= 5.0.0-beta.1, \u003c= 5.0.0-beta.31)","@auth/core (\u003e= 0.1.0, \u003c 0.41.3)"],"_cs_severities":["critical"],"_cs_tags":["account-takeover","authentication-bypass","web-vulnerability","magic-link","unicode-normalization"],"_cs_type":"advisory","_cs_vendors":["Auth.js"],"content_html":"\u003cp\u003eA critical vulnerability exists in Auth.js, specifically affecting \u003ccode\u003enext-auth\u003c/code\u003e versions \u003ccode\u003e\u0026gt;= 4.0.0, \u0026lt; 4.24.14\u003c/code\u003e, \u003ccode\u003e\u0026gt;= 4.10.3, \u0026lt; 4.24.15\u003c/code\u003e, \u003ccode\u003e\u0026gt;= 5.0.0-beta.1, \u0026lt;= 5.0.0-beta.31\u003c/code\u003e and \u003ccode\u003e@auth/core\u003c/code\u003e versions \u003ccode\u003e\u0026gt;= 0.1.0, \u0026lt; 0.41.3\u003c/code\u003e, when using the default email/magic-link sign-in provider. The flaw stems from the email normalizer validating an address \u003cem\u003ebefore\u003c/em\u003e applying Unicode normalization (NFKC/NFKD). This allows an attacker to craft an email address containing a Unicode character that is not an ASCII \u003ccode\u003e@\u003c/code\u003e (U+0040) but canonicalizes to one after normalization. This bypasses the normalizer's single-\u003ccode\u003e@\u003c/code\u003e check, causing a downstream mail library that performs Unicode normalization to interpret the address with two \u003ccode\u003e@\u003c/code\u003e separators. Consequently, the passwordless sign-in link is misrouted to an attacker-controlled mailbox, enabling account takeover without requiring any victim interaction.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a target's email address and crafts a malicious version by inserting a Unicode homoglyph character that resembles '@' (e.g., \u003ccode\u003evictim_email[U+XXXX]attacker.com\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker submits this crafted email address to the vulnerable Auth.js application's magic-link sign-in flow.\u003c/li\u003e\n\u003cli\u003eThe application's default \u003ccode\u003enormalizeIdentifier\u003c/code\u003e function validates the address, incorrectly perceiving only one '@' symbol because validation occurs prior to Unicode normalization.\u003c/li\u003e\n\u003cli\u003eThe application proceeds to send the magic-link email, with the crafted address passed to a downstream mail library or service.\u003c/li\u003e\n\u003cli\u003eThe mail library or service, which performs Unicode normalization (e.g., NFKC) for internationalized email, processes the recipient address.\u003c/li\u003e\n\u003cli\u003eDuring normalization, the homoglyph character in the crafted email canonicalizes to a second '@' symbol (e.g., \u003ccode\u003evictim_email@attacker.com\u003c/code\u003e), causing the mail service to misroute the magic link.\u003c/li\u003e\n\u003cli\u003eThe magic link is delivered to the attacker-controlled mailbox, enabling the attacker to authenticate and gain unauthorized access to the victim's account.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of this vulnerability is account takeover. An attacker who knows a victim's email address can exploit this flaw to request a magic link that is subsequently delivered to an attacker-controlled mailbox. The attacker can then use this link to sign in as the victim, gaining full access to their account. No victim interaction is required for the link to be misrouted, as the attacker initiates and directly receives the authentication link. This can lead to unauthorized access to personal data, financial information, or sensitive corporate resources, depending on the scope and permissions of the compromised account.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003enext-auth\u003c/code\u003e to a patched version (currently pending, refer to GHSA-7rqj-j65f-68wh for updates) immediately.\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@auth/core\u003c/code\u003e to a patched version (currently pending, refer to GHSA-7rqj-j65f-68wh for updates) immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not possible, implement a custom \u003ccode\u003enormalizeIdentifier\u003c/code\u003e on the email provider that calls \u003ccode\u003eidentifier.normalize(\u0026quot;NFKC\u0026quot;)\u003c/code\u003e \u003cem\u003ebefore\u003c/em\u003e any validation, and ensures only one '@' remains after normalization, as detailed in the GHSA advisory.\u003c/li\u003e\n\u003cli\u003eAlternatively, as a workaround, reject any email addresses containing non-ASCII characters if your user base does not require internationalized email addresses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T14:42:37Z","date_published":"2026-07-23T14:42:37Z","id":"https://feed.craftedsignal.io/briefs/2026-07-authjs-homoglyph-bypass/","summary":"A critical vulnerability in Auth.js libraries (next-auth and @auth/core) affects the email/magic-link sign-in flow, allowing an attacker to craft an email address with a homoglyph character that bypasses validation before Unicode normalization, leading to magic links being misrouted to attacker-controlled mailboxes and enabling account takeover without victim interaction.","title":"Auth.js Email Normalizer Vulnerability Allows Homoglyph Bypass Leading to Account Takeover","url":"https://feed.craftedsignal.io/briefs/2026-07-authjs-homoglyph-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Unicode-Normalization","version":"https://jsonfeed.org/version/1.1"}