update lock file

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "next-auth",
-  "version": "3.29.8",
+  "version": "3.29.10",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "next-auth",
-      "version": "3.29.8",
+      "version": "3.29.10",
       "funding": [
         {
           "type": "github",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "next-auth",
-  "version": "3.29.9",
+  "version": "3.29.10",
   "description": "Authentication for Next.js",
   "homepage": "https://next-auth.js.org",
   "repository": "https://github.com/nextauthjs/next-auth.git",

src/server/routes/signin.js

@@ -38,12 +38,20 @@ export default async function signin(req, res) {
     // according to RFC 2821, but in practice this causes more problems than
     // it solves. We treat email addresses as all lower case. If anyone
     // complains about this we can make strict RFC 2821 compliance an option.
-    const email = req.body.email?.toLowerCase() ?? null
+    let email = req.body.email?.toLowerCase() ?? null
 
     if (!email) {
       return res.redirect(`${baseUrl}${basePath}/error?error=EmailSignin`)
     }
 
+    // Get the first two elements only,
+    // separated by `@` from user input.
+    let [local, domain] = email.split("@")
+    // The part before "@" can contain a ","
+    // but we remove it on the domain part
+    domain = domain.split(",")[0]
+    email = `${local}@${domain}`
+
     // If is an existing user return a user object (otherwise use placeholder)
     const profile = (await getUserByEmail(email)) || { email }
     const account = { id: provider.id, type: "email", providerAccountId: email }