Unauthorized Request Handling Vulnerability in NextAuth.js Authentication for Next.js
CVE-2026-73418
What is CVE-2026-73418?
NextAuth.js, an authentication provider for Next.js, has a vulnerability in its getToken() helper that may throw an uncaught exception when processing a malformed Authorization: Bearer header. Specifically, this occurs if there is no session cookie present, leading to a scenario where the bearer value is URL-decoded before validation. Maliciously crafted percent-encoded strings can trigger this issue, potentially causing a per-request denial of service in API routes, middleware, or server-side request handlers without exposing sensitive information or bypassing authentication. The vulnerability has been addressed in versions @auth/core 0.41.3, next-auth 4.24.15, and 5.0.0-beta.32.
Affected Version(s)
core >= 0.1.0, < 0.41.3
next-auth >= 4.0.6, <= 4.24.14 <= 4.0.6, 4.24.14
next-auth >= 5.0.0-beta.0, <= 5.0.0-beta.31 <= 5.0.0-beta.0, 5.0.0-beta.31