{"answers":{"affected":"2 open source packages ship an affected version, including next-auth.","exploited":"There is no known exploitation of CVE-2026-73421 in the wild and no public exploit code.","fix":"Upgrade next-auth to 5.0.0-beta.32 or later.","what":"CVE-2026-73421 is a critical authentication bypass vulnerability in nextauthjs next-auth, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-73421 and fix it if it is affected.\n\nWhat it is: CVE-2026-73421 is a critical authentication bypass vulnerability in nextauthjs next-auth, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-73421 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- next-auth (npm): affected from 5.0.0-beta.0; fixed in 5.0.0-beta.32\n- next-auth (npm): affected from 5.0.0-beta.0; fixed in 5.0.0-beta.32\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-73421/ (Markdown: https://insights.sbomify.com/CVE-2026-73421/index.md)","id":"CVE-2026-73421","markdown":"https://insights.sbomify.com/CVE-2026-73421/index.md","name":"CVE-2026-73421","record":{"aliases":["GHSA-8fpg-xm3f-6cx3"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"NextAuth.js authentication library","requires_auth":"none","summary":"Misconfigured NextAuth.js deployments allow unauthenticated users to bypass access controls due to error objects being treated as valid sessions.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":9.1,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-636","name":"Not Failing Securely"},{"id":"CWE-285","name":"Improper Authorization"}],"description":"NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)","id":"CVE-2026-73421","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"auth_bypass","year":"2026"},"n_packages":2,"n_references":3,"next":{"headline":"Astro: Reflected XSS via unescaped View Transition animation properties","id":"CVE-2026-73422"},"packages":[{"ecosystem":"npm","fixed":["5.0.0-beta.32"],"introduced":["5.0.0-beta.0"],"last_affected":[],"package":"next-auth","purl":null,"source":"GHSA-8fpg-xm3f-6cx3"},{"ecosystem":"npm","fixed":["5.0.0-beta.32"],"introduced":["5.0.0-beta.0"],"last_affected":[],"package":"next-auth","purl":"pkg:npm/next-auth","source":"GHSA-8fpg-xm3f-6cx3"}],"prev":{"headline":"NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass","id":"CVE-2026-73420"},"products":["next-auth"],"published":"2026-08-13","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-18","vendors":["nextauthjs"]},"summary":"Misconfigured NextAuth.js deployments allow unauthenticated users to bypass access controls due to error objects being treated as valid sessions.","url":"https://insights.sbomify.com/CVE-2026-73421/"}