{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/next-auth/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@auth/core","next-auth"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","web-application","javascript","input-validation"],"_cs_type":"advisory","_cs_vendors":["Auth.js"],"content_html":"\u003cp\u003eA high-severity vulnerability has been identified in the \u003ccode\u003egetToken()\u003c/code\u003e helper within the \u003ccode\u003enext-auth\u003c/code\u003e and \u003ccode\u003e@auth/core\u003c/code\u003e JavaScript libraries, specifically affecting versions \u003ccode\u003e\u0026lt;= 5.0.0-beta.25\u003c/code\u003e for \u003ccode\u003enext-auth\u003c/code\u003e and \u003ccode\u003e\u0026lt; 0.41.3\u003c/code\u003e for \u003ccode\u003e@auth/core\u003c/code\u003e. This flaw, tracked as CWE-20 (Improper Input Validation), enables an unauthenticated attacker to induce a denial-of-service condition. When an application that directly calls \u003ccode\u003egetToken()\u003c/code\u003e receives a request with a malformed \u003ccode\u003eAuthorization: Bearer\u003c/code\u003e header containing invalid percent-encoding, the function attempts to URL-decode the value. This decoding step can trigger an uncaught exception if not explicitly handled by the application, causing the request handler to crash or become unresponsive. This impacts application availability, particularly in API routes, middleware, and server-side request handlers where \u003ccode\u003egetToken()\u003c/code\u003e is commonly employed, though it does not expose sensitive data or bypass authentication.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker crafts an HTTP request targeting a web application that uses the vulnerable \u003ccode\u003egetToken()\u003c/code\u003e helper.\u003c/li\u003e\n\u003cli\u003eThe attacker includes a malformed \u003ccode\u003eAuthorization: Bearer\u003c/code\u003e header in the request, where the bearer token portion contains invalid percent-encoding (e.g., \u003ccode\u003e%xx\u003c/code\u003e where \u003ccode\u003exx\u003c/code\u003e is not a valid hexadecimal character).\u003c/li\u003e\n\u003cli\u003eThe web application's API route, middleware, or server-side request handler receives the malicious request and calls the \u003ccode\u003egetToken()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003egetToken()\u003c/code\u003e function, in the absence of a session cookie, attempts to URL-decode the malformed bearer value from the \u003ccode\u003eAuthorization\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eDue to the invalid percent-encoding, the URL-decoding process fails and throws an uncaught exception within the \u003ccode\u003egetToken()\u003c/code\u003e helper.\u003c/li\u003e\n\u003cli\u003eUnless the application has a specific \u003ccode\u003etry/catch\u003c/code\u003e block surrounding the \u003ccode\u003egetToken()\u003c/code\u003e call, this uncaught exception propagates, leading to the crash or unresponsiveness of the request handler.\u003c/li\u003e\n\u003cli\u003eThe application experiences a denial-of-service condition for that specific request, impacting availability.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of this vulnerability is a denial of service (DoS). An unauthenticated request containing a specially crafted, malformed \u003ccode\u003eAuthorization: Bearer\u003c/code\u003e header can cause an unhandled exception in any application handler that invokes the \u003ccode\u003egetToken()\u003c/code\u003e function directly. This results in the affected request failing to complete, rendering the specific endpoint unavailable for that transaction. The impact is isolated to individual requests and primarily affects application availability. It does not lead to the exposure of tokens, session data, or other sensitive information, nor does it bypass existing authentication mechanisms. The vulnerability is categorized under CWE-20: Improper Input Validation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003enext-auth\u003c/code\u003e to a patched version greater than \u003ccode\u003e5.0.0-beta.31\u003c/code\u003e or \u003ccode\u003e4.24.14\u003c/code\u003e (or \u003ccode\u003e@auth/core\u003c/code\u003e to \u003ccode\u003e0.41.3\u003c/code\u003e or newer) to automatically address the vulnerability.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not possible, implement a \u003ccode\u003etry/catch\u003c/code\u003e block around all calls to \u003ccode\u003egetToken()\u003c/code\u003e within your application code to handle potential exceptions gracefully and treat them as an invalid token.\u003c/li\u003e\n\u003cli\u003eConsider deploying an edge proxy or middleware to strip or normalize incoming \u003ccode\u003eAuthorization\u003c/code\u003e headers with malformed percent-encoding before they reach the application.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T14:45:37Z","date_published":"2026-07-23T14:45:37Z","id":"https://feed.craftedsignal.io/briefs/2026-07-authjs-dos/","summary":"A vulnerability in the Auth.js `getToken()` helper function (next-auth and @auth/core) allows unauthenticated attackers to trigger an uncaught exception via a malformed `Authorization: Bearer` header, leading to a per-request denial of service in affected applications.","title":"Auth.js getToken() Vulnerability Leads to Denial of Service","url":"https://feed.craftedsignal.io/briefs/2026-07-authjs-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Next-Auth","version":"https://jsonfeed.org/version/1.1"}