Loading story…
A critical vulnerability tracked as CVE-2026-73421 and GHSA-8fpg-xm3f-6cx3 affects NextAuth.js / next-auth in the v5 beta series before 5.0.0-beta.32, allowing authentication checks to fail open under server misconfiguration. When provider settings were invalid—such as missing issuer or authorization endpoints, or an unset AUTH_SECRET—@auth/core could return an HTTP 500 response containing a JSON error object, and NextAuth wrappers incorrectly treated that body as session data instead of rejecting it.
Because the returned error object was truthy, common authorization patterns such as checking whether auth or req.auth existed could mistakenly grant access to unauthenticated requests and expose protected routes. The maintainers fixed the issue in next-auth@5.0.0-beta.32 by making non-OK session responses return null so auth() fails closed, and the release also pulled in related security hardening from @auth/core@0.41.3, including fixes for malformed Bearer token handling, provider-bound OAuth check cookies, and NFKC email normalization.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
GitHub security advisories published CVE-2026-73421 for NextAuth.js / next-auth, describing a critical authentication bypass caused by existence-based auth checks failing open under server misconfiguration. The advisory rated the issue Critical with a CVSS 4.0 base score of 9.1 and identified 5.0.0-beta.32 as the fixed version.
The next-auth project released version 5.0.0-beta.32, incorporating the fix for the fail-open authentication issue along with other security updates from @auth/core@0.41.3. The release changed non-OK session handling so checks such as !!auth no longer grant access on configuration errors.
A next-auth commit fixed a flaw where invalid provider configuration could cause auth() wrappers to treat an error object as a valid session, potentially exposing protected routes. The change introduced logic to return null on non-OK session responses and added regression tests to ensure auth() entry points fail closed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in **Next.js** tracked as `CVE-2025-29927` allows attackers to bypass authorization controls when applications rely on **Middleware** for access checks under specific deployment conditions. Researchers showed that specially crafted requests using the `x-middleware-subrequest` header can cause Middleware processing to be skipped, forwarding requests directly to protected endpoints. The issue was described as an authorization bypass with a **CVSS 9.1** severity rating and was later detailed by the Next.js team in a postmortem. The flaw affects multiple Next.js release lines, with fixes released in **15.2.3**, **14.2.25**, **13.5.9**, and **12.3.5**. Guidance from defenders and the vendor says organizations should patch immediately, and those unable to update should block external requests containing the `x-middleware-subrequest` header. The exposure is tied to applications run with `next start` using the `output: 'standalone'` setting, while hosted Next.js deployments on **Vercel** and **Netlify** were reported as protected from this issue.
Sep 3, 2026
Vercel has patched three high-severity vulnerabilities in **Next.js** that could allow **server-side request forgery (SSRF)** and, in a narrower configuration, bypass middleware-based authentication. The flaws are tracked as `CVE-2026-64645`, `CVE-2026-64649`, and `CVE-2026-64642`, each rated **CVSS 8.3**, and affect multiple supported branches of the framework. According to the advisory coverage, the SSRF issues can be triggered under specific configurations, while the authentication bypass affects deployments using the **App Router** and **Turbopack** in a limited scenario. The issues were fixed in **Next.js 16.2.11** and **15.5.21**, with no public proof-of-concept or confirmed in-the-wild exploitation reported at publication time. Defenders are advised to upgrade promptly, avoid user-controlled external destination hostnames, validate `Host` and `X-Forwarded-Host` headers, and enforce authorization checks in server-side page logic rather than relying solely on middleware protections.
Jul 23, 2026
A critical **Next.js** flaw tracked as `CVE-2025-29927` exposed applications using middleware-based authorization to authentication and authorization bypass, allowing protected routes to be reached without intended access checks. Public reporting described the issue as a middleware bypass bug affecting deployments that relied on Next.js middleware for security decisions, prompting urgent guidance for defenders to identify exposed internet-facing applications and remediate vulnerable implementations. The vulnerability was rapidly operationalized after disclosure, with multiple GitHub repositories publishing **proof-of-concept exploits**, vulnerable demo apps, Docker labs, and automated detection tools. These included scanners and hunters designed to identify susceptible Next.js sites, as well as exploitation-focused projects advertising middleware auth bypass and route access validation, increasing the likelihood of broad reconnaissance and opportunistic abuse against unpatched environments.
Jul 12, 2026