Summary
CVE-2026-73421 is an improper authorization vulnerability in NextAuth.js (Auth.js) v5 that causes the library to fail open rather than fail closed when the server encounters a configuration error. Applications that authorize requests by simply checking for the existence of the auth object (e.g., if (req.auth) or !!auth) can be tricked into granting access to unauthenticated users once a misconfiguration occurs. The issue carries a CVSS score of 9.1 (Critical).
Technical details
- Root cause: when Auth.js hits a server configuration error (e.g., a missing
AUTH_SECRET, or a provider missing both the issuer and authorization endpoint, triggeringInvalidEndpoints), it parses the resulting non-OK session response into a truthy error object instead of returningnull. - Trigger condition: the bypass only manifests after a deployment becomes misconfigured; in a correctly configured environment there is no impact.
- Attack vector: Network — no authentication or user interaction is required to exploit a misconfigured instance; the flaw is reachable through any protected route, middleware, Route Handler, or React Server Component that gates access via
auth(). - Impact: routes and pages protected solely by "does an auth object exist" logic silently grant access to unauthenticated visitors, resulting in an authorization bypass with high confidentiality and integrity impact.
Affected software
next-auth(NextAuth.js / Auth.js v5) versions 5.0.0-beta.0 through 5.0.0-beta.31
Severity
- CVSS Score: 9.1 (Critical)
- CVSS v4.0 Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate: Upgrade to
next-authversion 5.0.0-beta.32 or later, which fixes the fail-open behavior. - If immediate patching isn’t possible:
- Change authorization checks to validate a concrete session property rather than mere object existence, e.g.
const isLoggedIn = !!req.auth?.userinstead of!!req.auth. - Treat Auth.js error log lines as failed health checks at the deployment level so misconfigured builds are prevented from reaching production.
- Rely on role-based access control decisions rather than solely on session presence for authorization.
- Change authorization checks to validate a concrete session property rather than mere object existence, e.g.

