Auth.js @auth/core Security Advisory: Authorization Header Handling Issues and Homograph Bypass

Vulnerability Overview In , the following vulnerabilities exist: 1. returns instead of throwing an exception: When the header contains an improperly formatted Bearer value, the method returns rather than throwing an exception. 2. OAuth state, nonce, and PKCE check cookie binding issues: These cookies are now bound to the provider that created them and are rejected when callbacks are handled by a different provider. 3. Email address Unicode normalization issues: Email addresses undergo Unicode normalization (NFKC) before validation by the default email normalizer, which may lead to homograph bypasses. Affected Scope method: Any application using the method may be affected, particularly when handling the header. OAuth state, nonce, and PKCE check cookies: Applications using the OAuth flow may be impacted by the cookie binding issues. Email address validation: Any application relying on email address validation may be susceptible to homograph bypasses. Remediation method: Ensure that the method properly throws an exception when the header contains an improperly formatted Bearer value. OAuth state, nonce, and PKCE check cookies: Ensure that these cookies are correctly bound to the provider that created them and are properly rejected when callbacks are handled by a different provider. Email address validation: Ensure that email addresses are correctly normalized (NFKC) before validation by the default email normalizer to prevent homograph bypasses. POC Code or Exploit Code No specific POC code or exploit code was provided.

Goal Reached Thanks to every supporter — we hit 100%!

Auth.js @auth/core Security Advisory: Authorization Header Handling Issues and Homograph Bypass

More from this source