CVE-2026-73421

Name of the Vulnerable Software and Affected Versions next-auth versions 5.0.0-beta.0 through 5.0.0-beta.31

Description Applications using the auth() wrapper to gate access by checking only for the existence of the returned object can fail open during server configuration errors. In middleware, Route Handlers, and React Server Components, a non-OK session response is parsed as a truthy error object rather than null. Consequently, checks like !!auth or if (req.auth) evaluate to true for unauthenticated requests. This behavior is triggered by server configuration errors, such as an unset AUTH SECRET or a provider missing both the issuer and authorization endpoints, which triggers InvalidEndpoints. When a deployment is misconfigured, routes protected solely by session existence grant access to all visitors.

Recommendations Update to next-auth version 5.0.0-beta.32.