Attack Chain

1. An Auth.js next-auth v5 application is deployed, utilizing existence-based session checks (e.g., if (req.auth) or !!auth) in middleware or route handlers to protect resources.
2. A server-side configuration error occurs within the Auth.js setup, such as an incomplete OAuth provider configuration (e.g., missing issuer or authorization endpoints for Keycloak) or an unset AUTH_SECRET environment variable.
3. This misconfiguration causes Auth.js to log an internal error (e.g., [auth][error] InvalidEndpoints) and populate the auth object, typically used for session data, with an error object instead of null.
4. When the application's middleware or route handlers perform a session check (e.g., const isLoggedIn = !!auth), the truthy error object causes isLoggedIn to evaluate as true.
5. All subsequent requests, including those from unauthenticated users, are treated as if they possess a valid session.
6. The application "fails open," granting unauthorized access to protected resources and routes that were intended for authenticated users only.
7. This authentication bypass occurs silently, as the application behaves as if a valid session exists for every request, potentially leading to widespread unauthorized access without explicit error indications to the user or administrators.

Impact

This vulnerability, an instance of CWE-636 (Not Failing Securely / "Failing Open") leading to improper authorization (CWE-285), can lead to severe consequences. If an affected application becomes misconfigured, all protected resources become openly accessible to anyone, regardless of authentication status. The failure is silent, meaning administrators may not be immediately aware that their authentication mechanisms are bypassed. This could result in unauthorized data exposure, manipulation, or complete compromise of systems, impacting confidentiality, integrity, and availability. While no specific victim count is provided, any organization using vulnerable next-auth versions with the described access pattern is at risk, particularly those with dynamic deployment environments where configuration changes are frequent.

Recommendation

• Upgrade next-auth to the patched version (next-auth@beta or later stable release) immediately to ensure configuration errors fail closed.
• Modify existing session checks in next-auth middleware and route handlers to explicitly check for a user or session property (e.g., !!req.auth?.user) instead of just !!req.auth to prevent misconfiguration from being treated as a valid session.
• Implement robust deployment pipeline checks to monitor for [auth][error] log messages from your application, treating them as critical failures to prevent misconfigured applications from reaching production environments.