Actions
SecOps #1494
open
CD
[Sécurité] Dépendance vulnérable : next-auth@4.24.13 (GHSA-7rqj-j65f-68wh)
SecOps #1494:
[Sécurité] Dépendance vulnérable : next-auth@4.24.13 (GHSA-7rqj-j65f-68wh)
Status:
Submitted
Priority:
Normal
Assignee:
-
Start date:
07/24/2026
Due date:
% Done:
0%
Estimated time:
spec_ref:
build_status:
build_number:
ci_run_url:
scan_status:
scan_report_url:
deploy_status:
preprod_url:
deployed_at:
branch:
pr_url:
security_key:
next-auth@4.24.13_GHSA-7rqj-j65f-68wh
severity:
critical
paused:
Description
**Sévérité** : CRITICAL
**Source** : Trivy
`vuln-critical`
**Paquet** : next-auth@4.24.13
**Version corrigée** : 4.24.15, 5.0.0-beta.32
**Identifiant** : GHSA-7rqj-j65f-68wh
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
### Lien CVE
https://github.com/advisories/GHSA-7rqj-j65f-68wh
### Recommandations
Mettre à jour next-auth vers 4.24.15, 5.0.0-beta.32.
Actions