NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-73421 · CVE overview and exploitation status

EUVD-2026-58523

GHSA-8fpg-xm3f-6cx3

cve-program · CVE-2026-73421

• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3
• https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f
• https://github.com/nextauthjs/next-auth/releases/tag/[email protected]

euvd · EUVD-2026-58523

• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3
• https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f
• https://github.com/nextauthjs/next-auth/releases/tag/[email protected]

nvd · CVE-2026-73421

• https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f
• https://github.com/nextauthjs/next-auth/releases/tag/[email protected]
• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3

osv · GHSA-8fpg-xm3f-6cx3

• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3
• https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f
• https://github.com/nextauthjs/next-auth
• https://github.com/nextauthjs/next-auth/releases/tag/[email protected]

No related changes are available here.