CVE-2026-73421 Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
Misconfigured NextAuth.js deployments allow unauthenticated users to bypass access controls due to error objects being treated as valid sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73421?
CVE-2026-73421 is a critical authentication bypass vulnerability in nextauthjs next-auth, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.
Which versions are affected by CVE-2026-73421?
2 open source packages ship an affected version, including next-auth.
| Package | Affected | Fixed in |
|---|---|---|
next-auth npm | From 5.0.0-beta.0 | 5.0.0-beta.32 |
next-auth npm | From 5.0.0-beta.0 | 5.0.0-beta.32 |
How do I fix CVE-2026-73421?
Upgrade next-auth to 5.0.0-beta.32 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-73421 being exploited?
There is no known exploitation of CVE-2026-73421 in the wild and no public exploit code.
Sources
Also known as GHSA-8fpg-xm3f-6cx3.