PT-2026-71920 · Npm · Next-Auth
CVE-2026-73421
·
Published
2026-07-23
·
Updated
2026-08-18
CVSS v4.0
9.1
Critical
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
next-auth versions 5.0.0-beta.0 through 5.0.0-beta.31
Description
Applications using the
auth() wrapper to gate access by checking only for the existence of the returned object can fail open during server configuration errors. In middleware, Route Handlers, and React Server Components, a non-OK session response is parsed as a truthy error object rather than null. Consequently, checks like !!auth or if (req.auth) evaluate to true for unauthenticated requests. This behavior is triggered by server configuration errors, such as an unset AUTH SECRET or a provider missing both the issuer and authorization endpoints, which triggers InvalidEndpoints. When a deployment is misconfigured, routes protected solely by session existence grant access to all visitors.Recommendations
Update to next-auth version 5.0.0-beta.32.
Exploit
Fix
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Next-Auth