Executive brief
Auth.js (formerly NextAuth.js) is a popular authentication library for web applications. A vulnerability exists where certain configuration errors cause the system to incorrectly report that a user is logged in, even when they are not. This can lead to unauthorized users gaining full access to protected parts of an application if the developer relies on simple existence checks for the authentication object.
Technical details
In Auth.js v5, when a server-side configuration error occurs (such as a missing AUTH_SECRET or invalid provider endpoints), the auth() wrapper returns an error object rather than null. Because JavaScript treats objects as 'truthy', common authorization patterns like 'if (req.auth)' or '!!auth' will evaluate to true for all requests, including unauthenticated ones. This results in a fail-open condition (CWE-636) leading to improper authorization (CWE-285). The vulnerability is triggered when a previously valid configuration becomes invalid, causing the application to silently stop enforcing authentication. A fix is available in version 5.0.0-beta.32.
Affected products
- Auth.js next-auth >= 5.0.0-beta.0, <= 5.0.0-beta.31
Timeline
- 2026-07-20: disclosed
- 2026-07-23: advisory
- 2026-07-23: patched: Released in next-auth@5.0.0-beta.32
References
- https://api.github.com/users/marc-zollingkoffer-syzygy
- https://github.com/marc-zollingkoffer-syzygy
- https://api.github.com/users/marc-zollingkoffer-syzygy/gists%7B/gist_id%7D
- https://api.github.com/users/marc-zollingkoffer-syzygy/repos
- https://avatars.githubusercontent.com/u/128495132?v=4
- https://api.github.com/users/marc-zollingkoffer-syzygy/events%7B/privacy%7D