EUVD-2026-57552
GHSA-xmf8-cvqr-rfgj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-accessible trigger via HTTP header requires no privileges or user interaction; impact is availability only with no confidentiality or integrity effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Blast Radius
ecosystem impact- 1 npm packages depend on @auth/core (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.1.0.
DescriptionCVE.org
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
AnalysisAI
Denial of service in NextAuth.js's getToken() helper allows unauthenticated remote attackers to crash any API route, middleware, or server-side handler that calls getToken() directly by sending a single HTTP request with a malformed Authorization: Bearer header containing invalid percent-encoding. The vulnerability affects next-auth 4.0.6-4.24.14, next-auth 5.0.0-beta.0-5.0.0-beta.31, and @auth/core 0.1.0-0.41.2, and is fixed in next-auth 4.24.15, next-auth 5.0.0-beta.32, and @auth/core 0.41.3. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The application must call getToken() directly from next-auth/jwt or @auth/core/jwt in an API route, middleware, or server-side request handler - applications that exclusively use the framework's auth() helper and never call getToken() themselves are NOT affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 High rating (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures the unauthenticated, low-complexity, network-accessible nature of the attack with pure availability impact and no confidentiality or integrity risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a single HTTP GET or POST request to any endpoint that calls getToken() directly, setting the Authorization header to 'Bearer %ZZ' or any other syntactically invalid percent-encoded value. The decodeURIComponent() call inside getToken() immediately throws a URIError, which propagates as an unhandled exception through the request handler, returning an error response to the attacker and denying service for that request. … |
| Remediation | Upgrade to next-auth 4.24.15 (https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.24.15), next-auth 5.0.0-beta.32 (https://github.com/nextauthjs/next-auth/releases/tag/next-auth%405.0.0-beta.32), or @auth/core 0.41.3 (https://github.com/nextauthjs/next-auth/releases/tag/%40auth%2Fcore%400.41.3) as appropriate for your installed package; no application code changes are required alongside the package upgrade. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all production and staging deployments to identify NextAuth.js or @auth/core usage and current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
NextAuth.js is an open source authentication solution for Next.js applications. Rated high severity (CVSS 8.8), this vul
NextAuth.js is a complete open source authentication solution for Next.js applications. Rated medium severity (CVSS 6.1)
NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Rated medium severity (CVSS
NextAuth.js is a complete open source authentication solution for Next.js applications. Rated critical severity (CVSS 9.
`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.
NextAuth.js is a complete open source authentication solution for Next.js applications. Rated high severity (CVSS 7.5),
Provider-confusion in NextAuth.js (next-auth and @auth/core) allows an attacker to link their own OAuth identity at a ta
NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Rated medium severity (CVSS
next-auth v3 users before version 3.29.2 are impacted. Rated medium severity (CVSS 6.1), this vulnerability is remotely
NextAuth.js provides authentication for Next.js. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploi
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today