{"id":"GHSA-8fpg-xm3f-6cx3","revision":null,"records":[{"revision":"0684a5d35b074325add759d10d5c2298","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-73421","aliases":[],"title":"NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)","description":"NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.","state":0,"publishedAt":"2026-08-13T22:04:36.985+00:00","modifiedAt":"2026-08-18T01:45:41.913+00:00","affected":[{"ecosystem":"Vendor product","name":"next-auth","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"nextauthjs\",\n                    \"product\": \"next-auth\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 5.0.0-beta.4, < 5.0.0-beta.32\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3","https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-73421","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-73421","identifiers":["CVE-2026-73421"]},"retained":false,"historicalAffected":[]},{"revision":"1acdb927afd44921bb014f2096061e86","observedAt":"2026-11-11T16:05:23.475+00:00","statement":{"source":"euvd","id":"EUVD-2026-58523","aliases":["CVE-2026-73421","GHSA-8fpg-xm3f-6cx3"],"title":"NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js …","description":"NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":9.1,"severity":null}],"references":["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3","https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-58523","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 13, 2026, 10:04:36 PM","dateUpdated":"Aug 18, 2026, 1:45:41 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-58523","identifiers":["EUVD-2026-58523","CVE-2026-73421","GHSA-8fpg-xm3f-6cx3"]},"retained":false,"historicalAffected":[]},{"revision":"a60856252d05403fb058385ecfa8b96a","observedAt":"2026-10-25T15:19:09.409+00:00","statement":{"source":"nvd","id":"CVE-2026-73421","aliases":[],"title":"NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js …","description":"NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.","state":0,"publishedAt":"2026-08-13T22:17:26.447+00:00","modifiedAt":"2026-09-18T20:05:53.723+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32","https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73421","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-285","CWE-636"],"productCriteria":[],"sourceDates":{"published":"2026-08-13T22:17:26.447","lastModified":"2026-09-18T20:05:53.723"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-73421","identifiers":["CVE-2026-73421"]},"retained":false,"historicalAffected":[]},{"revision":"fa5f3a88da1b47fda088c09a61bf943b","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-8fpg-xm3f-6cx3","aliases":["CVE-2026-73421"],"title":"Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)","description":"### Impact\n\n`next-auth` (Auth.js) v5 applications that gate access by checking only for the **existence** of the `auth` object — the pattern shown in the official [session management / protecting resources guide](https://authjs.dev/getting-started/session-management/protecting) — are affected.\n\nWhen the Auth.js configuration produces a server-side error, the `auth` object exposed by the `auth()` wrapper (in middleware, Route Handlers, etc.) is **populated with an error object instead of being `null`**:\n\n```json\n{ \"message\": \"There was a problem with the server configuration. Check the server logs for more information.\" }\n```\n\nBecause this object is truthy, any authorization check of the form `!!auth` (or `if (req.auth)`) evaluates to `true` for **every** request, including unauthenticated ones. The application *fails open*: instead of denying access when the auth layer is broken, it grants access to everyone.\n\n```ts\n// middleware.ts — affected pattern\nexport default auth((req) => {\n  const { nextUrl, auth } = req\n  const isLoggedIn = !!auth // <-- always true when the configuration is broken\n  // ...\n})\n```\n\nA representative trigger is a provider that is missing required configuration. For example, a Keycloak provider with neither `issuer` nor `authorization` endpoint set logs:\n\n```\n[auth][error] InvalidEndpoints: Provider \"keycloak\" is missing both `issuer` and `authorization` endpoint config. At least one of them is required.\n```\n\n…and from that point on `auth` is the error object above, so `!!auth` is permanently `true`. The same fail-open behavior occurs for other server-configuration errors (for example, an unset `AUTH_SECRET`).\n\nThere is **no impact while the configuration is valid**. The risk materializes when a previously-working deployment becomes misconfigured — e.g. an environment variable is changed or removed during a deploy — at which point existence-based auth checks silently stop protecting routes and all visitors are treated as authenticated. Because the failure mode is silent and grants access to everyone, the consequences can be severe.\n\nThis is an instance of CWE-636 (Not Failing Securely / \"Failing Open\") leading to improper authorization (CWE-285).\n\n### Patches\n\nThe fix ensures that a server-configuration error no longer surfaces as a truthy `auth` object: existence checks fail **closed** rather than open. This is released in `next-auth@<!-- TODO: set patched version on publish -->`.\n\nTo upgrade:\n\n```sh\nnpm i next-auth@beta\n```\n```sh\nyarn add next-auth@beta\n```\n```sh\npnpm add next-auth@beta\n```\n\n### Workarounds\n\nIf you cannot upgrade immediately, check for a concrete user/session property rather than the bare object, so a configuration-error object is not treated as an authenticated session:\n\n```ts\n// middleware.ts\nexport default auth((req) => {\n  // `auth.user` is only present on a real session; resilient to config-error objects\n  const isLoggedIn = !!req.auth?.user\n  // ...\n})\n```\n\nAs defense in depth, make Auth.js configuration errors fail loudly in your deployment pipeline (for example, treat `[auth][error]` log lines as a failed health check) so a broken configuration cannot silently reach production. As always, an existing session indicates authentication only — for authorization, perform an explicit role/permission check rather than relying on session existence. See the [role-based access control guide](https://authjs.dev/guides/role-based-access-control).\n\n### References\n\n- Protecting resources / session management: https://authjs.dev/getting-started/session-management/protecting\n- Role-based access control (RBAC): https://authjs.dev/guides/role-based-access-control\n- Auth.js error reference: https://authjs.dev/reference/core/errors\n\n### For more information\n\nIf you have any concerns, Auth.js requests responsible disclosure, outlined here: https://authjs.dev/security\n\n### Credits\n\nReported by @marc-zollingkoffer-syzygy.","state":0,"publishedAt":"2026-07-23T14:52:23+00:00","modifiedAt":"2026-08-12T20:56:01.891204+00:00","affected":[{"ecosystem":"npm","name":"next-auth","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"5.0.0-beta.0"},{"kind":"fixed","version":"5.0.0-beta.32"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3","https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f","https://github.com/nextauthjs/next-auth","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"],"sourceUrl":"https://github.com/advisories/GHSA-8fpg-xm3f-6cx3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8fpg-xm3f-6cx3","identifiers":["GHSA-8fpg-xm3f-6cx3","CVE-2026-73421"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-13T04:18:36.4231440+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-13T04:18:36.423144+00:00","lastSuccessAt":"2026-11-13T04:18:36.6499472+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:18:36.6499505+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d8fa82e95fdb59244e2f635e667ba17f0796ca0a4f1f4bb8cc31febcd660b76c-eec2a7b6fa103d7adf500db624fb62eee17c31f1d368f8ffbfab89234260d0bb","complete":true,"records":424956,"lastAttemptAt":"2026-11-13T04:16:36.7627787+00:00","lastSuccessAt":"2026-11-13T04:16:36.734253+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:16:36.7627787+00:00","snapshotPublishedAt":"2026-11-13T03:23:36+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e04a199e7d564def944246e638d9fcaf","complete":false,"records":13793,"lastAttemptAt":"2026-11-13T04:28:27.2271603+00:00","lastSuccessAt":"2026-11-13T04:28:27.21+00:00","error":"466 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-13T04:28:27.21+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13347,"expectedIdentifiers":13846,"failedIdentifiers":466},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-13T04:18:36.4231440+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-13T04:18:36.423144+00:00","lastSuccessAt":"2026-11-13T04:18:36.6506845+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:18:36.6506847+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-77eeb9ad53d240dc91f8e3d507ac52a2","complete":true,"records":13781,"lastAttemptAt":"2026-11-13T04:18:42.8820004+00:00","lastSuccessAt":"2026-11-13T04:18:42.877+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:18:42.877+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13846,"expectedIdentifiers":13846,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-93e76d404e1aeb6a7e8902f5ffa06211fc86dea3b1958e297abb2668aa5e6e8c","complete":true,"records":9952,"lastAttemptAt":"2026-11-13T04:18:36.3735153+00:00","lastSuccessAt":"2026-11-12T23:19:15.5239119+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:18:36.3735153+00:00","snapshotPublishedAt":"2026-11-12T23:03:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-13T04:16:36.9142039+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:16:36.9142039+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-20d1a8ab073a1c13ab2143dbcadb34ebb8edf1e18e16482b448513662c3d1e12","complete":true,"records":3127,"lastAttemptAt":"2026-11-13T04:18:36.3861738+00:00","lastSuccessAt":"2026-11-12T22:18:31.0338213+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:18:36.3861738+00:00","snapshotPublishedAt":"2026-11-12T22:18:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f70b10812c5ddf50a1d5d3981278bc04de2258aeffba4d04b8366dfdb415cc24","complete":true,"records":231754,"lastAttemptAt":"2026-11-13T04:18:36.2431554+00:00","lastSuccessAt":"2026-11-13T04:18:34.7446316+00:00","error":null,"lastVerifiedAt":"2026-11-13T04:18:36.2431554+00:00","snapshotPublishedAt":"2026-11-13T03:47:53+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}