CyberRota Analysis
AI-GeneratedNextAuth.js versions from 5.0.0-beta.0 to 5.0.0-beta.32 are vulnerable due to a flaw in session validation that allows unauthenticated access when the server configuration is incorrect. Specifically, applications relying solely on the presence of the auth object may inadvertently grant access to unauthorized users if configuration errors occur, posing a significant security risk. Organizations using NextAuth.js for authentication should prioritize upgrading to version 5.0.0-beta.32 to mitigate this critical vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.