CVE-2026-73420 | NextAuth.js @auth/core/next-auth Email Normalization defaultNormalizer improper authentication

A vulnerability classified as critical was found in NextAuth.js @auth, core and next-auth. This vulnerability affects the function defaultNormalizer of the component Email Normalization. Such manipulation leads to improper authentication.

This vulnerability is uniquely identified as CVE-2026-73420. The attack can be launched remotely. No exploit exists.