CVE-2026-73421: Auth.js authentication check bypass on configuration error

CVE-2026-73421 · Severity: medium · CVSS 4 · Published 2026-08-13

Auth.js is a widely-used authentication library for Next.js applications. When the Auth.js configuration contains errors (such as missing environment variables or incomplete provider settings), the authentication object is populated with an error instead of remaining null. Because this error object is truthy, security checks that verify if a user is logged in (like "if (auth)") incorrectly evaluate to true for all requests, including those from unauthenticated users. In practice, if a deployment becomes misconfigured during an update, all access controls silently fail and the application grants full access to everyone.

Technologies: next-auth (npm). Vendors: npm.

Quick answers

Is CVE-2026-73421 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73421 being exploited in the wild.
How severe is CVE-2026-73421?
Medium severity, with a CVSS score of 4, published 13 August 2026.
Which products and versions are affected?
next-auth (npm) SEMVER:introduced=5.0.0-beta.0,fixed=5.0.0-beta.32.
Is there a fix for CVE-2026-73421?
Yes. next-auth (npm): upgrade to 5.0.0-beta.32 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73421 attacked?
It is attacked over the network.
Am I affected by CVE-2026-73421?
Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • next-auth (npm): upgrade to 5.0.0-beta.32 or later
    npm install next-auth@5.0.0-beta.32

Technical details

This vulnerability is an instance of CWE-636 (Not Failing Securely / Failing Open) leading to improper authorization (CWE-285). The root cause is in the auth() wrapper function used in middleware and route handlers: when Auth.js configuration validation fails (e.g., missing AUTH_SECRET, incomplete Keycloak provider settings), the function returns a truthy error object instead of null. Developers following the official Auth.js documentation check for session existence using patterns like "!!auth" or "if (req.auth)", which evaluate to true when an error object is present. The attack vector is network-based; no special authentication or user interaction is required. An attacker can trigger misconfiguration by manipulating deployment environment (removing variables, changing settings), causing all protected routes to become accessible to unauthenticated users. The fix, released in next-auth version 5.0.0-beta.32, ensures configuration errors no longer produce a truthy auth object, making existence checks fail closed instead of open.

Affected products

  • NextAuth.js next-auth >= 5.0.0-beta.0, <= 5.0.0-beta.31

Identifiers

  • CVE-2026-73421
  • GHSA-8fpg-xm3f-6cx3

Timeline

  • 2026-07-23: disclosed
  • 2026-07-20: patched: Fixed in next-auth version 5.0.0-beta.32

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.