Improper Access Control in Tenda FH1202 /goform/SysToolChangePwd

This repository is a proof-of-concept (POC) for CVE-2025-29927, an authorization bypass vulnerability in Next.js (versions 11 through 15.x). The repository contains a minimal Next.js application with a custom middleware (middleware.js) that checks for a specific Authorization header on all /api/* routes. The exploit leverages the 'x-middleware-subrequest' HTTP header to nest middleware invocations, which causes the authorization check to be bypassed, granting unauthorized access to protected endpoints such as /api/hello. The README.md provides detailed reproduction steps, including curl commands for both normal and exploitative requests, and explains how the exploit applies to different Next.js versions (with both middleware.js and _middleware.js naming conventions). The repository structure is typical for a Next.js app, with configuration files and a single middleware implementation. No fake or destructive code is present; the repository is focused on demonstrating the vulnerability and its exploitation.