A vulnerability classified as critical was found in NextAuth.js @auth, core and next-auth . This vulnerability affects the function defaultNormalizer of the component Email Normalization . Such manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-73420 . The attack can be launched remotely. No exploit exists.