# CVE-2026-73418: NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken()

Source: https://junglewise.ai/threats/cve-2026-73418-auth-js-gettoken-exception-on-malformed-bearer-headers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73418 · Severity: high · CVSS 7.5 · Published 2026-08-12

Auth.js is an authentication library used to manage user sessions and tokens in web applications. A flaw in the getToken() function causes it to crash when processing malformed HTTP Authorization headers, resulting in service disruption for any application that calls this function directly without error handling.

Technologies: [@auth/core (npm)](https://junglewise.ai/threats/technologies/auth-core), [next-auth (npm)](https://junglewise.ai/threats/technologies/next-auth). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73418 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73418 being exploited in the wild.

**How severe is CVE-2026-73418?** High severity, with a CVSS score of 7.5, published 12 August 2026.

**Which products and versions are affected?** @auth/core (npm) SEMVER:introduced=0.1.0,fixed=0.41.3; next-auth (npm) SEMVER:introduced=5.0.0-beta.0,fixed=5.0.0-beta.32.

**Is there a fix for CVE-2026-73418?** Yes. @auth/core (npm): upgrade to 0.41.3 or later; next-auth (npm): upgrade to 5.0.0-beta.32 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73418 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73418?** Check whether you run @auth/core (npm) or next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @auth/core (npm): upgrade to 0.41.3 or later

  ```sh
  npm install @auth/core@0.41.3
  ```

- next-auth (npm): upgrade to 5.0.0-beta.32 or later

  ```sh
  npm install next-auth@5.0.0-beta.32
  ```


## Technical details

This is an improper input validation vulnerability (CWE-20) in the getToken() helper function exported from next-auth and @auth/core. When processing an Authorization: Bearer header without a session cookie present, the function attempts to URL-decode the Bearer token value before validation. Malformed percent-encoding in the Bearer value causes the decoding operation to throw an uncaught exception rather than treating it as an invalid token. The vulnerability is reachable over the network without authentication or user interaction, affecting any API route, middleware, or request handler that calls getToken() directly. An attacker can send a single unauthenticated request with a crafted malformed Bearer header to trigger a denial-of-service condition. Patches are available in @auth/core 0.41.3 and later, next-auth 4.24.15 and later, and next-auth 5.0.0-beta.32 and later.

## Affected products

- Auth.js @auth/core 0.1.0 to 0.41.2
- Auth.js next-auth 4.0.6 to 4.24.14, 5.0.0-beta.0 to 5.0.0-beta.31

## Identifiers

- CVE-2026-73418
- GHSA-xmf8-cvqr-rfgj

## Timeline

- 2026-07-23: disclosed: Advisory published
- 2026-08-12: advisory: NVD published CVE-2026-73418

## References

- [https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xmf8-cvqr-rfgj](https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xmf8-cvqr-rfgj)

## Related threats

- [Auth.js authentication check bypass on configuration error](https://junglewise.ai/threats/cve-2026-73421-auth-js-authentication-check-bypass-on-configuration-error)
- [Auth.js email normalizer homoglyph @ bypass in passwordless sign-in](https://junglewise.ai/threats/cve-2026-73420-auth-js-email-normalizer-homoglyph-bypass-in-passwordless-sign-in)
- [Auth.js OAuth provider-confusion in state/nonce/PKCE cookies](https://junglewise.ai/threats/cve-2026-73419-auth-js-oauth-provider-confusion-in-state-nonce-pkce-cookies)
- [NextAuth.js email misdelivery via nodemailer address parser bug](https://junglewise.ai/threats/nextauth-js-email-misdelivery-via-nodemailer-address-parser-bug-6824743e)
- [NextAuth.js authentication bypass via mock user creation](https://junglewise.ai/threats/cve-2023-48309-nextauth-js-authentication-bypass-via-mock-user-creation)