# CVE-2026-73421: Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

> Misconfigured NextAuth.js deployments allow unauthenticated users to bypass access controls due to error objects being treated as valid sessions.

- **Severity:** Critical 9.1 (`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 13 Aug 2026
- **Updated:** 18 Aug 2026
- **Also known as:** GHSA-8fpg-xm3f-6cx3

## What is CVE-2026-73421?

CVE-2026-73421 is a critical authentication bypass vulnerability in nextauthjs next-auth, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.

Weakness: CWE-636 (Not Failing Securely), CWE-285 (Improper Authorization)

## Which versions are affected by CVE-2026-73421?

2 open source packages ship an affected version, including next-auth.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `next-auth` | npm | From 5.0.0-beta.0 | 5.0.0-beta.32 |
| `next-auth` | npm | From 5.0.0-beta.0 | 5.0.0-beta.32 |

## How do I fix CVE-2026-73421?

Upgrade next-auth to 5.0.0-beta.32 or later.

## Is CVE-2026-73421 being exploited?

There is no known exploitation of CVE-2026-73421 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-73421 and fix it if it is affected.

What it is: CVE-2026-73421 is a critical authentication bypass vulnerability in nextauthjs next-auth, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-73421 in the wild and no public exploit code.

Affected packages and fixed versions:
- next-auth (npm): affected from 5.0.0-beta.0; fixed in 5.0.0-beta.32
- next-auth (npm): affected from 5.0.0-beta.0; fixed in 5.0.0-beta.32

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-73421/ (Markdown: https://insights.sbomify.com/CVE-2026-73421/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-73421
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73421
- OSV: https://osv.dev/vulnerability/CVE-2026-73421

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-73421/
Summaries are generated and may contain mistakes; the official description above is the record.