Executive brief
Auth.js is a widely-used authentication library for Next.js applications. When the Auth.js configuration contains errors (such as missing environment variables or incomplete provider settings), the authentication object is populated with an error instead of remaining null. Because this error object is truthy, security checks that verify if a user is logged in (like "if (auth)") incorrectly evaluate to true for all requests, including those from unauthenticated users. In practice, if a deployment becomes misconfigured during an update, all access controls silently fail and the application grants full access to everyone.
Technical details
This vulnerability is an instance of CWE-636 (Not Failing Securely / Failing Open) leading to improper authorization (CWE-285). The root cause is in the auth() wrapper function used in middleware and route handlers: when Auth.js configuration validation fails (e.g., missing AUTH_SECRET, incomplete Keycloak provider settings), the function returns a truthy error object instead of null. Developers following the official Auth.js documentation check for session existence using patterns like "!!auth" or "if (req.auth)", which evaluate to true when an error object is present. The attack vector is network-based; no special authentication or user interaction is required. An attacker can trigger misconfiguration by manipulating deployment environment (removing variables, changing settings), causing all protected routes to become accessible to unauthenticated users. The fix, released in next-auth version 5.0.0-beta.32, ensures configuration errors no longer produce a truthy auth object, making existence checks fail closed instead of open.
Affected products
- NextAuth.js next-auth >= 5.0.0-beta.0, <= 5.0.0-beta.31
Timeline
- 2026-07-23: disclosed
- 2026-07-20: patched: Fixed in next-auth version 5.0.0-beta.32