Skip to content
Threat Feed
Subscribe

Vendor

Auth.js

3 briefs RSS
critical advisory

Auth.js (next-auth) v5 Configuration Error Leads to Authentication Bypass

A critical configuration error vulnerability in `next-auth` (Auth.js) v5 applications, specifically versions v5.0.0-beta.0 through v5.0.0-beta.31, can lead to a 'fail-open' state where server-side configuration issues cause the `auth` object to be populated with an error instead of `null`, effectively bypassing authentication checks and granting unauthorized access to protected resources.

next-auth v5.0.0-beta.0 to v5.0.0-beta.31 authentication-bypass configuration-error web-application security-vulnerability
2t
medium advisory

Auth.js getToken() Vulnerability Leads to Denial of Service

A vulnerability in the Auth.js `getToken()` helper function (next-auth and @auth/core) allows unauthenticated attackers to trigger an uncaught exception via a malformed `Authorization: Bearer` header, leading to a per-request denial of service in affected applications.

@auth/core +1 denial-of-service vulnerability web-application javascript input-validation
1t
critical advisory

Auth.js Email Normalizer Vulnerability Allows Homoglyph Bypass Leading to Account Takeover

A critical vulnerability in Auth.js libraries (next-auth and @auth/core) affects the email/magic-link sign-in flow, allowing an attacker to craft an email address with a homoglyph character that bypasses validation before Unicode normalization, leading to magic links being misrouted to attacker-controlled mailboxes and enabling account takeover without victim interaction.

next-auth +3 account-takeover authentication-bypass web-vulnerability magic-link unicode-normalization
2t