NextAuth.js CVE-2026-73421
CRITICAL
GHSA-8fpg-xm3f-6cx3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network bypass (PR:N/UI:N) but conditioned on a pre-existing misconfiguration outside attacker control, hence AC:H; full read/write of protected resources gives C:H/I:H, no availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.
AnalysisAI
Authorization bypass (fail-open) in NextAuth.js (Auth.js) v5 affects applications on next-auth 5.0.0-beta.0 through 5.0.0-beta.31 that protect routes by checking only whether the auth() object exists. When Auth.js hits a server-side configuration error, the auth object is populated with a truthy error payload instead of null, so checks like !!auth or if (req.auth) evaluate true for every unauthenticated request. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target application to be in a broken Auth.js server-configuration state - specifically an unset AUTH_SECRET, or a provider (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N, base 9.1) captures the essential nuance: exploitation is network-based and unauthenticated (PR:N) with low attack complexity, but carries an Attack Requirement (AT:P) - the target application must both be in a broken server-configuration state AND rely on the existence-only auth pattern. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An operator removes or renames AUTH_SECRET (or ships a provider missing its issuer/authorization endpoint) during a routine deploy of a next-auth v5 app whose middleware protects /dashboard with const isLoggedIn = !!auth. From that moment @auth/core returns a 500 error object, !!auth becomes permanently true, and any anonymous visitor browsing to protected routes is treated as authenticated and served the content. … |
| Remediation | Primary fix: upgrade to Vendor-released patch next-auth 5.0.0-beta.32 (npm i next-auth@beta or pin next-auth@5.0.0-beta.32), which makes auth() return null on any non-OK session response so existence checks fail closed; see GHSA-8fpg-xm3f-6cx3 and commit d008b9b764bf4b322a87e1822d1dda7789258d8f. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your deployment for any Auth.js configuration errors (check server logs and Auth.js error reporting) and identify which Auth.js versions are currently in production. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today