CVE-2026-73419
MediumAdvisory
Published 23 Jul 2026In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.8
- base score, highest
- EPSS
- 0.002
- 9th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 12
- of 17,781 indexed, latest versions
- Container images
- 12
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Carried by container images the latest versions of 12 of 17,781 indexed charts deploy, on 12 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| next-authnpm | 4.22.0, 4.24.5, 4.24.11, 4.24.14+1 more | 4.24.15, 5.0.0-beta.32 | 8 |
| @auth/ | 0.9.0, 0.27.0, 0.37.2, 0.41.2 | 0.41.3 | 6 |
- OSV records
- GHSA-x445-f3h2-j279
Charts affected
12 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| homarroben01Verified publisher | 1.4.0 | 1 of 1See more | 2,581 |
| karakeephelmforgeVerified publisher | 1.2.9 | 1 of 3See more | 9,460 |
| karakeepself-hosters-by-nightVerified publisher | 2.5.1 | 1 of 1See more | 5,213 |
| wraftwraft | 0.1.12 | 1 of 9See more | 10,090 |
| linkwardenadnoctemVerified publisher | 0.5.1 | 1 of 2See more | 3,820 |
| katalogalpineworks | 0.1.2 | 1 of 5See more | 4,497 |
| documensodocumensoVerified publisher | 0.0.6 | 1 of 2See more | 2,862 |
| portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher | 0.1.0 | 1 of 3See more | 1,498 |
| lynxpromptlynxpromptVerified publisher | 0.1.2 | 1 of 3See more | 1,852 |
| karakeeprtomik-helm-chartsVerified publisher | 0.0.1 | 1 of 3See more | 5,338 |
| homarrvhdirkVerified publisher | 0.1.5 | 1 of 1See more | 2,789 |
| websitewaldo-visionVerified publisher | 0.33.0 | 1 of 2See more | 3,474 |
Container images carrying it
12 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| documenso/ | 7f16a9449f18 | next-auth | 4.24.15 | 1 |
| drumsergio/ | c6afb6679301 | @auth/ next-auth | 0.41.3 4.24.15 | 1 |
| ghcr.io/ | 737ec361ed24 | next-auth | 4.24.15 | 1 |
| ghcr.io/ | e103abadfb52 | next-auth | 4.24.15 | 1 |
| ghcr.io/ | 34b76dcb1c10 | @auth/ next-auth | 0.41.3 5.0.0-beta.32 | 1 |
| ghcr.io/ | 56efa3085895 | next-auth | 4.24.15 | 1 |
| ghcr.io/ | abd7d6b11b1b | @auth/ | 0.41.3 | 1 |
| ghcr.io/ | b069e4307dec | @auth/ | 0.41.3 | 1 |
| ghcr.io/ | f575a34ed3f8 | @auth/ | 0.41.3 | 1 |
| ghcr.io/ | 0664c28a039b | @auth/ | 0.41.3 | 1 |
| ghcr.io/ | 5bbc7647df07 | next-auth | 4.24.15 | 1 |
| quay.io/ | f1bbbd5e9bb9 | next-auth | 4.24.15 | 1 |