NextAuth.js versions prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32 use a defaultNormalizer that validates email addresses before applying Unicode normalization. Unicode characters such as U+FF20 FULLWIDTH COMMERCIAL AT can pass the single-at-sign check but normalize to ASCII '@', resulting in downstream mail libraries or delivery services seeing multiple '@' characters. This discrepancy allows an attacker who knows a victim's email address to request a magic link that is misrouted to an attacker-controlled recipient, enabling unauthorized sign-in without victim interaction. The vulnerability is addressed by fixing the normalization order in the specified patched versions.

An attacker who knows a victim's email address can exploit this vulnerability to receive passwordless sign-in links intended for the victim, allowing unauthorized access to the victim's account without their interaction. This compromises account security and authentication integrity in affected NextAuth.js implementations using the default email normalizer and downstream Unicode normalization.

A fix is available in @auth/core 0.41.3, next-auth 4.24.15, and 5.0.0-beta.32. Users should upgrade to these or later versions to resolve the issue. Applications using a custom normalizeIdentifier or not relying on the built-in normalizer may not be affected. Patch status is not explicitly stated beyond these fixed versions; verify with vendor advisories for the latest remediation guidance.