Authentication Bypass Vulnerability in NextAuth.js from Vercel

CVE-2026-73421

What is CVE-2026-73421?

NextAuth.js, an authentication solution for Next.js applications, has a vulnerability that could lead to unauthorized access due to improper session checks. In versions 5.0.0-beta.0 through 5.0.0-beta.31, the framework may return a truthy error object for non-OK session responses when misconfigured, thereby allowing unauthenticated users to gain access to restricted routes. This occurs particularly when the auth object is checked solely for its existence, without validating the session's authenticity. Proper configurations are critical to mitigating this issue, and users are advised to upgrade to version 5.0.0-beta.32 to enhance security.

References