Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability affects Next.js applications using the NextAuth.js library for email or magic-link sign-ins. If specific conditions are met regarding email normalization, an attacker could potentially intercept a passwordless sign-in link and impersonate a legitimate user. The primary concern is to confirm whether your applications utilize this authentication flow and are exposed to this specific normalization issue.
- Email sign-ins could be misrouted to attackers.
- Confirms relevance and exposure for critical authentication.
- Assess impact and ensure proper email normalization.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability by knowing a victim's email address and crafting it with a special Unicode character. This character is then incorrectly processed by the email normalization feature, causing the passwordless sign-in link to be sent to an address controlled by the attacker instead of the victim. By intercepting this link, the attacker can gain access to the victim's account.
- Attacker knows victim's email.
- Victim's email is sent for normalization.
- Account takeover via misdirected link.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, a specific Unicode character in an email address could allow an attacker to receive a passwordless sign-in link intended for a victim. This occurs if the application's email provider uses a default identifier normalizer that does not correctly handle certain Unicode characters before a downstream mail service applies its own normalization, leading to the link being sent to an attacker-controlled address.
- User account access.
- Malicious link interception.
- Unauthorized account access.
Operational Fix
Recommended remediation, mitigation, and detection steps
Application owners and platform teams are likely responsible for addressing this vulnerability in their Next.js applications. The first practical step is to identify all instances of the affected authentication library, confirm their reachability and business criticality, and then determine the accountable owner for remediation planning.
- Application owners should own the issue.
- Verify affected applications and their reachability.
- Plan remediation based on identified risk.
