Vulnerability-Lookup

CVE-2026-73421 (GCVE-0-2026-73421)

Vulnerability from cvelistv5 – Published: 2026-08-13 22:04 – Updated: 2026-08-13 22:04

Title

NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Summary

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.

Severity

9.1 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-285 - Improper Authorization
CWE-636 - Not Failing Securely ('Failing Open')

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/nextauthjs/next-auth/security/…	x_refsource_CONFIRM
https://github.com/nextauthjs/next-auth/commit/d0…	x_refsource_MISC
https://github.com/nextauthjs/next-auth/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nextauthjs	next-auth	Affected: >= 5.0.0-beta.4, < 5.0.0-beta.32

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "next-auth",
          "vendor": "nextauthjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-beta.4, \u003c 5.0.0-beta.32"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-636",
              "description": "CWE-636: Not Failing Securely (\u0027Failing Open\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T22:04:36.985Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f"
        },
        {
          "name": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"
        }
      ],
      "source": {
        "advisory": "GHSA-8fpg-xm3f-6cx3",
        "discovery": "UNKNOWN"
      },
      "title": "NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73421",
    "datePublished": "2026-08-13T22:04:36.985Z",
    "dateReserved": "2026-08-12T14:32:11.795Z",
    "dateUpdated": "2026-08-13T22:04:36.985Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73421",
      "date": "2026-08-14",
      "epss": "0.00644",
      "percentile": "0.47752"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-73421\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-13T22:17:26.447\",\"lastModified\":\"2026-08-13T22:17:26.447\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"nextauthjs\",\"product\":\"next-auth\",\"versions\":[{\"version\":\"\u003e= 5.0.0-beta.4, \u003c 5.0.0-beta.32\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"},{\"lang\":\"en\",\"value\":\"CWE-636\"}]}],\"references\":[{\"url\":\"https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

GHSA-8FPG-XM3F-6CX3

Vulnerability from github – Published: 2026-07-23 14:52 – Updated: 2026-08-12 20:31

Summary

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Details

Impact

next-auth (Auth.js) v5 applications that gate access by checking only for the existence of the auth object — the pattern shown in the official session management / protecting resources guide — are affected.

When the Auth.js configuration produces a server-side error, the auth object exposed by the auth() wrapper (in middleware, Route Handlers, etc.) is populated with an error object instead of being null:

{ "message": "There was a problem with the server configuration. Check the server logs for more information." }

Because this object is truthy, any authorization check of the form !!auth (or if (req.auth)) evaluates to true for every request, including unauthenticated ones. The application fails open: instead of denying access when the auth layer is broken, it grants access to everyone.

// middleware.ts — affected pattern
export default auth((req) => {
  const { nextUrl, auth } = req
  const isLoggedIn = !!auth // <-- always true when the configuration is broken
  // ...
})

A representative trigger is a provider that is missing required configuration. For example, a Keycloak provider with neither issuer nor authorization endpoint set logs:

[auth][error] InvalidEndpoints: Provider "keycloak" is missing both `issuer` and `authorization` endpoint config. At least one of them is required.

…and from that point on auth is the error object above, so !!auth is permanently true. The same fail-open behavior occurs for other server-configuration errors (for example, an unset AUTH_SECRET).

There is no impact while the configuration is valid. The risk materializes when a previously-working deployment becomes misconfigured — e.g. an environment variable is changed or removed during a deploy — at which point existence-based auth checks silently stop protecting routes and all visitors are treated as authenticated. Because the failure mode is silent and grants access to everyone, the consequences can be severe.

This is an instance of CWE-636 (Not Failing Securely / "Failing Open") leading to improper authorization (CWE-285).

Patches

The fix ensures that a server-configuration error no longer surfaces as a truthy auth object: existence checks fail closed rather than open. This is released in next-auth@.

To upgrade:

npm i next-auth@beta

yarn add next-auth@beta

pnpm add next-auth@beta

Workarounds

If you cannot upgrade immediately, check for a concrete user/session property rather than the bare object, so a configuration-error object is not treated as an authenticated session:

// middleware.ts
export default auth((req) => {
  // `auth.user` is only present on a real session; resilient to config-error objects
  const isLoggedIn = !!req.auth?.user
  // ...
})

As defense in depth, make Auth.js configuration errors fail loudly in your deployment pipeline (for example, treat [auth][error] log lines as a failed health check) so a broken configuration cannot silently reach production. As always, an existing session indicates authentication only — for authorization, perform an explicit role/permission check rather than relying on session existence. See the role-based access control guide.

References

Protecting resources / session management: https://authjs.dev/getting-started/session-management/protecting
Role-based access control (RBAC): https://authjs.dev/guides/role-based-access-control
Auth.js error reference: https://authjs.dev/reference/core/errors

For more information

If you have any concerns, Auth.js requests responsible disclosure, outlined here: https://authjs.dev/security

Credits

Reported by @marc-zollingkoffer-syzygy.

Severity

9.1 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.0-beta.31"
      },
      "package": {
        "ecosystem": "npm",
        "name": "next-auth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-beta.0"
            },
            {
              "fixed": "5.0.0-beta.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73421"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-636"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-23T14:52:23Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\n`next-auth` (Auth.js) v5 applications that gate access by checking only for the **existence** of the `auth` object \u2014 the pattern shown in the official [session management / protecting resources guide](https://authjs.dev/getting-started/session-management/protecting) \u2014 are affected.\n\nWhen the Auth.js configuration produces a server-side error, the `auth` object exposed by the `auth()` wrapper (in middleware, Route Handlers, etc.) is **populated with an error object instead of being `null`**:\n\n```json\n{ \"message\": \"There was a problem with the server configuration. Check the server logs for more information.\" }\n```\n\nBecause this object is truthy, any authorization check of the form `!!auth` (or `if (req.auth)`) evaluates to `true` for **every** request, including unauthenticated ones. The application *fails open*: instead of denying access when the auth layer is broken, it grants access to everyone.\n\n```ts\n// middleware.ts \u2014 affected pattern\nexport default auth((req) =\u003e {\n  const { nextUrl, auth } = req\n  const isLoggedIn = !!auth // \u003c-- always true when the configuration is broken\n  // ...\n})\n```\n\nA representative trigger is a provider that is missing required configuration. For example, a Keycloak provider with neither `issuer` nor `authorization` endpoint set logs:\n\n```\n[auth][error] InvalidEndpoints: Provider \"keycloak\" is missing both `issuer` and `authorization` endpoint config. At least one of them is required.\n```\n\n\u2026and from that point on `auth` is the error object above, so `!!auth` is permanently `true`. The same fail-open behavior occurs for other server-configuration errors (for example, an unset `AUTH_SECRET`).\n\nThere is **no impact while the configuration is valid**. The risk materializes when a previously-working deployment becomes misconfigured \u2014 e.g. an environment variable is changed or removed during a deploy \u2014 at which point existence-based auth checks silently stop protecting routes and all visitors are treated as authenticated. Because the failure mode is silent and grants access to everyone, the consequences can be severe.\n\nThis is an instance of CWE-636 (Not Failing Securely / \"Failing Open\") leading to improper authorization (CWE-285).\n\n### Patches\n\nThe fix ensures that a server-configuration error no longer surfaces as a truthy `auth` object: existence checks fail **closed** rather than open. This is released in `next-auth@\u003c!-- TODO: set patched version on publish --\u003e`.\n\nTo upgrade:\n\n```sh\nnpm i next-auth@beta\n```\n```sh\nyarn add next-auth@beta\n```\n```sh\npnpm add next-auth@beta\n```\n\n### Workarounds\n\nIf you cannot upgrade immediately, check for a concrete user/session property rather than the bare object, so a configuration-error object is not treated as an authenticated session:\n\n```ts\n// middleware.ts\nexport default auth((req) =\u003e {\n  // `auth.user` is only present on a real session; resilient to config-error objects\n  const isLoggedIn = !!req.auth?.user\n  // ...\n})\n```\n\nAs defense in depth, make Auth.js configuration errors fail loudly in your deployment pipeline (for example, treat `[auth][error]` log lines as a failed health check) so a broken configuration cannot silently reach production. As always, an existing session indicates authentication only \u2014 for authorization, perform an explicit role/permission check rather than relying on session existence. See the [role-based access control guide](https://authjs.dev/guides/role-based-access-control).\n\n### References\n\n- Protecting resources / session management: https://authjs.dev/getting-started/session-management/protecting\n- Role-based access control (RBAC): https://authjs.dev/guides/role-based-access-control\n- Auth.js error reference: https://authjs.dev/reference/core/errors\n\n### For more information\n\nIf you have any concerns, Auth.js requests responsible disclosure, outlined here: https://authjs.dev/security\n\n### Credits\n\nReported by @marc-zollingkoffer-syzygy.",
  "id": "GHSA-8fpg-xm3f-6cx3",
  "modified": "2026-08-12T20:31:20Z",
  "published": "2026-07-23T14:52:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nextauthjs/next-auth"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-73421 (GCVE-0-2026-73421)

GHSA-8FPG-XM3F-6CX3

Impact

Patches

Workarounds

References

For more information

Credits

Tags

Sightings

Nomenclature