Access Control Vulnerability in OpenNext Cloudflare Adapter
CVE-2026-100409

7.5HIGH

Key Information:

Vendor

Opennextjs

Status
Opennextjs-cloudflare
Vendor
CVE Published:
15 October 2026

What is CVE-2026-100409?

The OpenNext Cloudflare adapter for Next.js has a vulnerability that affects versions from 0.3.0 to 1.20.1. This issue arises when applications enable 'enableCacheInterception' and rely on middleware for access control. Specifically, the vulnerability allows unauthenticated attackers to exploit inconsistently processed percent-encoded pathnames. By crafting requests that bypass authorization checks, attackers can access protected cached routes. This allows them to retrieve sensitive content without proper authentication. The vulnerability has been addressed in version 1.20.2, which resolves the inconsistencies in pathname decoding.

Affected Version(s)

opennextjs-cloudflare >= 0.3.0, < 1.20.2

References

https://github.com/opennextjs/opennextjs-cloudflare/secur...
x_refsource_CONFIRM
https://github.com/opennextjs/opennextjs-aws/pull/1199
x_refsource_MISC
https://github.com/opennextjs/opennextjs-aws/pull/1200
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.