Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

NextAuth.js misconfiguration can let anyone in

CVE-2026-73421 · published 2 months ago
Summary

If a NextAuth.js setup is incorrectly configured, checks that only look for the presence of an auth object may mistakenly treat unauthenticated users as logged in. This can happen when required settings like AUTH_SECRET or provider endpoints are missing, causing protected pages to be accessible to anyone. Update to the latest version of NextAuth.js to ensure the auth object is correctly cleared when configuration errors occur.

What to do
  • Update better-gustavo next-auth to version 5.0.0-beta.32.
Affected software
Ecosystem VendorProductAffected versions
npm better-gustavo next-auth >= 5.0.0-beta.0, <= 5.0.0-beta.31
>= 5.0.0-beta.0, < 5.0.0-beta.32
Fix: upgrade to 5.0.0-beta.32
– nextauthjs next-auth >= 5.0.0-beta.4, < 5.0.0-beta.32
Original advisory text
NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-285Improper Authorization
CWE-636Not Failing Securely ('Failing Open')
Timeline
Published13 Aug 2026
Updated30 Oct 2026
First seen23 Jul 2026
Sources
CVE-2026-73421 · NVD
GHSA-8fpg-xm3f-6cx3 · GHSA
CVE-2026-73421 · OSV
CVE-2026-73421 · MITRE
GHSA-8fpg-xm3f-6cx3 · OSV
Track software like this
Free during beta