The flaw allows an attacker to exploit a Unicode character that normalizes to the ASCII at‑sign after validation. An attacker can craft an address containing a fullwidth at‑sign that passes the normalizer’s one‑at check but, when sent through a downstream mail library that performs Unicode normalization, turns into two at‑signs, causing the magic‑link email to be delivered to the attacker’s address. This enables the attacker to receive a passwordless sign‑in link and authenticate as the victim without user interaction.

Applications built with @auth/core before version 0.41.3 or next-auth before 4.24.15 (or 5.0.0‑beta.32) and that use the defaultNormalizer without a custom normalizeIdentifier are affected. The vulnerability exists when the downstream sendVerificationRequest implementation applies Unicode normalization. Users of later releases or custom normalizers are not affected.

The CVSS score of 9.1 reflects a high‑severity account‑takeover risk. Although EPSS is not available and the flaw is not listed in KEV, the attack vector is remote and requires only knowledge of the victim’s email address. An attacker can trigger the vulnerability by sending a magic‑link request; the mis‑normalized address causes the link to be delivered to the attacker, granting authentication as the victim. The risk remains significant until the affected packages are patched or mitigated.