CVE-2026-73421

Received Received - Intake

Authentication Bypass in NextAuth.js Session Handling

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73421

Affected Vendors & Products

Vendor	Product	Version / Range
next-auth	next-auth	From 5.0.0-beta.0 (inc) to 5.0.0-beta.32 (inc)
next-auth	next-auth	5.0.0-beta.32

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-636	When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects NextAuth.js versions 5.0.0-beta.0 to 5.0.0-beta.32. It allows unauthenticated access when server configuration errors occur, such as missing issuer, authorization endpoint, or unset AUTH_SECRET. The auth() function incorrectly returns a truthy error object instead of null, causing checks like !!auth to evaluate as true even for unauthenticated requests.

Detection Guidance

This vulnerability can be detected by checking if your NextAuth.js version is between 5.0.0-beta.0 and 5.0.0-beta.32. Run 'npm list next-auth' or 'yarn list next-auth' to verify the installed version. If the version is within the affected range, update to 5.0.0-beta.32 or later immediately.

Impact Analysis

If your application uses affected NextAuth.js versions and checks only for the existence of the auth object, unauthorized users could gain access to protected routes after a misconfiguration. This could lead to data breaches, unauthorized actions, or compromised user accounts without any visible errors.

Compliance Impact

This vulnerability could lead to unauthorized access to protected routes due to misconfiguration, potentially violating data protection requirements under GDPR and HIPAA. Unauthorized access may result in unauthorized data exposure or processing, which are key compliance concerns for these regulations.

Mitigation Strategies

Upgrade next-auth to version 5.0.0-beta.32 or later to fix the issue where unauthenticated requests are incorrectly granted access due to server configuration errors.

Hi! I’m here to help you understand CVE-2026-73421. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70