https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 18:45:34 +0000 https://vulnerability.circl.lu/vuln/ghsa-xmf8-cvqr-rfgj <p><strong>Affected:</strong> npm: @auth/core, npm: next-auth</p> <p>## Summary</p> <p>The exported `getToken()` helper (`next-auth/jwt` and `@auth/core/jwt`) can throw an uncaught exception when it reads a malformed `Authorization: Bearer …` header. When no session cookie is present, `getToken()` URL-decodes the bearer value before validating it, and malformed percent-encoding causes the decode step to throw rather than being treated as an invalid token. Because `getToken()` is commonly called in API routes, middleware, and other request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests.</p> <p>## Am I affected?</p> <p>You are affected if **all** of the following hold:</p> <p>- You use `next-auth` `&lt;= 5.0.0-beta.25` (or `@auth/core` exposing the same `getToken()` implementation). - Your application calls `getToken()` directly — for example in a Route Handler, middleware, or server-side request handler. - You do not wrap that `getToken()` call in your own `try/catch`.</p> <p>You are **not** affected if you only use the framework&#39;s `auth()` helper and never call `getToken()` yourself, or if every `getToken()` call site already has its own exception handling.</p> <p>## Impact</p> <p>- Denial of service: an unauthenticated request carrying a malformed Bearer authorization header can raise an unhandled exception in any handler that calls `getToken()`. - The impact is per-request and limited to availability; it does not expose tokens, sessions, or other data, and does not bypass authentication.</p> <p>CWE-20: Improper Input Va…</p> <p><strong>Affected:</strong> npm: @auth/core, npm: next-auth</p> <p>## Summary</p> <p>The exported `getToken()` helper (`next-auth/jwt` and `@auth/core/jwt`) can throw an uncaught exception when it reads a malformed `Authorization: Bearer …` header. When no session cookie is present, `getToken()` URL-decodes the bearer value before validating it, and malformed percent-encoding causes the decode step to throw rather than being treated as an invalid token. Because `getToken()` is commonly called in API routes, middleware, and other request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests.</p> <p>## Am I affected?</p> <p>You are affected if **all** of the following hold:</p> <p>- You use `next-auth` `&lt;= 5.0.0-beta.25` (or `@auth/core` exposing the same `getToken()` implementation). - Your application calls `getToken()` directly — for example in a Route Handler, middleware, or server-side request handler. - You do not wrap that `getToken()` call in your own `try/catch`.</p> <p>You are **not** affected if you only use the framework&#39;s `auth()` helper and never call `getToken()` yourself, or if every `getToken()` call site already has its own exception handling.</p> <p>## Impact</p> <p>- Denial of service: an unauthenticated request carrying a malformed Bearer authorization header can raise an unhandled exception in any handler that calls `getToken()`. - The impact is per-request and limited to availability; it does not expose tokens, sessions, or other data, and does not bypass authentication.</p> <p>CWE-20: Improper Input Va…</p> https://vulnerability.circl.lu/vuln/ghsa-xmf8-cvqr-rfgj