{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/next-auth-v5.0.0-beta.0-to-v5.0.0-beta.31/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["next-auth v5.0.0-beta.0 to v5.0.0-beta.31"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","configuration-error","web-application","security-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Auth.js"],"content_html":"\u003cp\u003eAuth.js (next-auth) v5 applications are affected by a critical configuration error vulnerability, GHSA-8fpg-xm3f-6cx3, where misconfigurations can lead to a \u0026quot;fail-open\u0026quot; state, bypassing authentication. This issue, first published on July 23, 2026, impacts versions \u003ccode\u003ev5.0.0-beta.0\u003c/code\u003e through \u003ccode\u003ev5.0.0-beta.31\u003c/code\u003e. When server-side configuration errors occur, such as missing OAuth provider settings or an unset \u003ccode\u003eAUTH_SECRET\u003c/code\u003e, the \u003ccode\u003eauth\u003c/code\u003e object, typically used to gate access, is erroneously populated with an error object instead of being \u003ccode\u003enull\u003c/code\u003e. This truthy error object causes common session existence checks (e.g., \u003ccode\u003eif (req.auth)\u003c/code\u003e) to evaluate as true for all incoming requests, including unauthenticated ones. Consequently, the application grants unauthorized access to protected resources, treating all visitors as authenticated. This silent failure mode poses a severe risk as it effectively renders authentication mechanisms useless without immediate detection.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn Auth.js \u003ccode\u003enext-auth\u003c/code\u003e v5 application is deployed, utilizing existence-based session checks (e.g., \u003ccode\u003eif (req.auth)\u003c/code\u003e or \u003ccode\u003e!!auth\u003c/code\u003e) in middleware or route handlers to protect resources.\u003c/li\u003e\n\u003cli\u003eA server-side configuration error occurs within the Auth.js setup, such as an incomplete OAuth provider configuration (e.g., missing \u003ccode\u003eissuer\u003c/code\u003e or \u003ccode\u003eauthorization\u003c/code\u003e endpoints for Keycloak) or an unset \u003ccode\u003eAUTH_SECRET\u003c/code\u003e environment variable.\u003c/li\u003e\n\u003cli\u003eThis misconfiguration causes Auth.js to log an internal error (e.g., \u003ccode\u003e[auth][error] InvalidEndpoints\u003c/code\u003e) and populate the \u003ccode\u003eauth\u003c/code\u003e object, typically used for session data, with an error object instead of \u003ccode\u003enull\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eWhen the application's middleware or route handlers perform a session check (e.g., \u003ccode\u003econst isLoggedIn = !!auth\u003c/code\u003e), the truthy error object causes \u003ccode\u003eisLoggedIn\u003c/code\u003e to evaluate as \u003ccode\u003etrue\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAll subsequent requests, including those from unauthenticated users, are treated as if they possess a valid session.\u003c/li\u003e\n\u003cli\u003eThe application \u0026quot;fails open,\u0026quot; granting unauthorized access to protected resources and routes that were intended for authenticated users only.\u003c/li\u003e\n\u003cli\u003eThis authentication bypass occurs silently, as the application behaves as if a valid session exists for every request, potentially leading to widespread unauthorized access without explicit error indications to the user or administrators.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability, an instance of CWE-636 (Not Failing Securely / \u0026quot;Failing Open\u0026quot;) leading to improper authorization (CWE-285), can lead to severe consequences. If an affected application becomes misconfigured, all protected resources become openly accessible to anyone, regardless of authentication status. The failure is silent, meaning administrators may not be immediately aware that their authentication mechanisms are bypassed. This could result in unauthorized data exposure, manipulation, or complete compromise of systems, impacting confidentiality, integrity, and availability. While no specific victim count is provided, any organization using vulnerable \u003ccode\u003enext-auth\u003c/code\u003e versions with the described access pattern is at risk, particularly those with dynamic deployment environments where configuration changes are frequent.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003enext-auth\u003c/code\u003e to the patched version (\u003ccode\u003enext-auth@beta\u003c/code\u003e or later stable release) immediately to ensure configuration errors fail closed.\u003c/li\u003e\n\u003cli\u003eModify existing session checks in \u003ccode\u003enext-auth\u003c/code\u003e middleware and route handlers to explicitly check for a user or session property (e.g., \u003ccode\u003e!!req.auth?.user\u003c/code\u003e) instead of just \u003ccode\u003e!!req.auth\u003c/code\u003e to prevent misconfiguration from being treated as a valid session.\u003c/li\u003e\n\u003cli\u003eImplement robust deployment pipeline checks to monitor for \u003ccode\u003e[auth][error]\u003c/code\u003e log messages from your application, treating them as critical failures to prevent misconfigured applications from reaching production environments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T14:59:25Z","date_published":"2026-07-23T14:59:25Z","id":"https://feed.craftedsignal.io/briefs/2026-07-authjs-fail-open/","summary":"A critical configuration error vulnerability in `next-auth` (Auth.js) v5 applications, specifically versions v5.0.0-beta.0 through v5.0.0-beta.31, can lead to a 'fail-open' state where server-side configuration issues cause the `auth` object to be populated with an error instead of `null`, effectively bypassing authentication checks and granting unauthorized access to protected resources.","title":"Auth.js (next-auth) v5 Configuration Error Leads to Authentication Bypass","url":"https://feed.craftedsignal.io/briefs/2026-07-authjs-fail-open/"}],"language":"en","title":"CraftedSignal Threat Feed - Next-Auth V5.0.0-Beta.0 to V5.0.0-Beta.31","version":"https://jsonfeed.org/version/1.1"}