Executive brief
Auth.js is an authentication library used to manage user sessions and tokens in web applications. A flaw in the getToken() function causes it to crash when processing malformed HTTP Authorization headers, resulting in service disruption for any application that calls this function directly without error handling.
Technical details
This is an improper input validation vulnerability (CWE-20) in the getToken() helper function exported from next-auth and @auth/core. When processing an Authorization: Bearer header without a session cookie present, the function attempts to URL-decode the Bearer token value before validation. Malformed percent-encoding in the Bearer value causes the decoding operation to throw an uncaught exception rather than treating it as an invalid token. The vulnerability is reachable over the network without authentication or user interaction, affecting any API route, middleware, or request handler that calls getToken() directly. An attacker can send a single unauthenticated request with a crafted malformed Bearer header to trigger a denial-of-service condition. Patches are available in @auth/core 0.41.3 and later, next-auth 4.24.15 and later, and next-auth 5.0.0-beta.32 and later.
Affected products
- Auth.js @auth/core 0.1.0 to 0.41.2
- Auth.js next-auth 4.0.6 to 4.24.14, 5.0.0-beta.0 to 5.0.0-beta.31
Timeline
- 2026-07-23: disclosed: Advisory published
- 2026-08-12: advisory: NVD published CVE-2026-73418