CVE-2026-73418: NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken()

CVE-2026-73418 · Severity: high · CVSS 7.5 · Published 2026-08-12

Auth.js is an authentication library used to manage user sessions and tokens in web applications. A flaw in the getToken() function causes it to crash when processing malformed HTTP Authorization headers, resulting in service disruption for any application that calls this function directly without error handling.

Technologies: @auth/core (npm), next-auth (npm). Vendors: npm.

Quick answers

Is CVE-2026-73418 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73418 being exploited in the wild.
How severe is CVE-2026-73418?
High severity, with a CVSS score of 7.5, published 12 August 2026.
Which products and versions are affected?
@auth/core (npm) SEMVER:introduced=0.1.0,fixed=0.41.3; next-auth (npm) SEMVER:introduced=5.0.0-beta.0,fixed=5.0.0-beta.32.
Is there a fix for CVE-2026-73418?
Yes. @auth/core (npm): upgrade to 0.41.3 or later; next-auth (npm): upgrade to 5.0.0-beta.32 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73418 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-73418?
Check whether you run @auth/core (npm) or next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @auth/core (npm): upgrade to 0.41.3 or later
    npm install @auth/core@0.41.3
  • next-auth (npm): upgrade to 5.0.0-beta.32 or later
    npm install next-auth@5.0.0-beta.32

Technical details

This is an improper input validation vulnerability (CWE-20) in the getToken() helper function exported from next-auth and @auth/core. When processing an Authorization: Bearer header without a session cookie present, the function attempts to URL-decode the Bearer token value before validation. Malformed percent-encoding in the Bearer value causes the decoding operation to throw an uncaught exception rather than treating it as an invalid token. The vulnerability is reachable over the network without authentication or user interaction, affecting any API route, middleware, or request handler that calls getToken() directly. An attacker can send a single unauthenticated request with a crafted malformed Bearer header to trigger a denial-of-service condition. Patches are available in @auth/core 0.41.3 and later, next-auth 4.24.15 and later, and next-auth 5.0.0-beta.32 and later.

Affected products

  • Auth.js @auth/core 0.1.0 to 0.41.2
  • Auth.js next-auth 4.0.6 to 4.24.14, 5.0.0-beta.0 to 5.0.0-beta.31

Identifiers

  • CVE-2026-73418
  • GHSA-xmf8-cvqr-rfgj

Timeline

  • 2026-07-23: disclosed: Advisory published
  • 2026-08-12: advisory: NVD published CVE-2026-73418

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.