From c6e6be87ac26bf79d0c050f023fed7e0c3796986 Mon Sep 17 00:00:00 2001
From: Jan Kahmen <36455663+kah-ja@users.noreply.github.com>
Date: Thu, 17 Sep 2026 13:28:32 +0000
Subject: [PATCH] fix: reject a verification token that does not match

useVerificationToken compared the supplied token only to decide whether
to delete the stored record, and returned that record either way.
next-auth treats any non null return value as a valid token, so the
email sign in completed with any token for a known identifier. Return
null unless the token matches, and delete only then. This also stops the
lookup throwing for an identifier that has no record.
---
 lib/nextAuthAdapter.ts | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/nextAuthAdapter.ts b/lib/nextAuthAdapter.ts
index fae9f1ec9..f58daa844 100644
--- a/lib/nextAuthAdapter.ts
+++ b/lib/nextAuthAdapter.ts
@@ -81,10 +81,13 @@ export default function Adapter() {
     },
     async useVerificationToken({ identifier, token }) {
       const tokenInStore = await (await store).get(identifier);
-      if (tokenInStore.token === token) {
-        await (await store).delete(identifier);
+      // next-auth treats any non null return value as a valid token, so the
+      // comparison has to decide the return value and not only the deletion.
+      if (!tokenInStore || tokenInStore.token !== token) {
+        return null;
       }
-      return tokenInStore ?? null;
+      await (await store).delete(identifier);
+      return tokenInStore;
     },
   };
 }