{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/auth.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["next-auth v5.0.0-beta.0 to v5.0.0-beta.31"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","configuration-error","web-application","security-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Auth.js"],"content_html":"\u003cp\u003eAuth.js (next-auth) v5 applications are affected by a critical configuration error vulnerability, GHSA-8fpg-xm3f-6cx3, where misconfigurations can lead to a \u0026quot;fail-open\u0026quot; state, bypassing authentication. This issue, first published on July 23, 2026, impacts versions \u003ccode\u003ev5.0.0-beta.0\u003c/code\u003e through \u003ccode\u003ev5.0.0-beta.31\u003c/code\u003e. When server-side configuration errors occur, such as missing OAuth provider settings or an unset \u003ccode\u003eAUTH_SECRET\u003c/code\u003e, the \u003ccode\u003eauth\u003c/code\u003e object, typically used to gate access, is erroneously populated with an error object instead of being \u003ccode\u003enull\u003c/code\u003e. This truthy error object causes common session existence checks (e.g., \u003ccode\u003eif (req.auth)\u003c/code\u003e) to evaluate as true for all incoming requests, including unauthenticated ones. Consequently, the application grants unauthorized access to protected resources, treating all visitors as authenticated. This silent failure mode poses a severe risk as it effectively renders authentication mechanisms useless without immediate detection.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn Auth.js \u003ccode\u003enext-auth\u003c/code\u003e v5 application is deployed, utilizing existence-based session checks (e.g., \u003ccode\u003eif (req.auth)\u003c/code\u003e or \u003ccode\u003e!!auth\u003c/code\u003e) in middleware or route handlers to protect resources.\u003c/li\u003e\n\u003cli\u003eA server-side configuration error occurs within the Auth.js setup, such as an incomplete OAuth provider configuration (e.g., missing \u003ccode\u003eissuer\u003c/code\u003e or \u003ccode\u003eauthorization\u003c/code\u003e endpoints for Keycloak) or an unset \u003ccode\u003eAUTH_SECRET\u003c/code\u003e environment variable.\u003c/li\u003e\n\u003cli\u003eThis misconfiguration causes Auth.js to log an internal error (e.g., \u003ccode\u003e[auth][error] InvalidEndpoints\u003c/code\u003e) and populate the \u003ccode\u003eauth\u003c/code\u003e object, typically used for session data, with an error object instead of \u003ccode\u003enull\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eWhen the application's middleware or route handlers perform a session check (e.g., \u003ccode\u003econst isLoggedIn = !!auth\u003c/code\u003e), the truthy error object causes \u003ccode\u003eisLoggedIn\u003c/code\u003e to evaluate as \u003ccode\u003etrue\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAll subsequent requests, including those from unauthenticated users, are treated as if they possess a valid session.\u003c/li\u003e\n\u003cli\u003eThe application \u0026quot;fails open,\u0026quot; granting unauthorized access to protected resources and routes that were intended for authenticated users only.\u003c/li\u003e\n\u003cli\u003eThis authentication bypass occurs silently, as the application behaves as if a valid session exists for every request, potentially leading to widespread unauthorized access without explicit error indications to the user or administrators.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability, an instance of CWE-636 (Not Failing Securely / \u0026quot;Failing Open\u0026quot;) leading to improper authorization (CWE-285), can lead to severe consequences. If an affected application becomes misconfigured, all protected resources become openly accessible to anyone, regardless of authentication status. The failure is silent, meaning administrators may not be immediately aware that their authentication mechanisms are bypassed. This could result in unauthorized data exposure, manipulation, or complete compromise of systems, impacting confidentiality, integrity, and availability. While no specific victim count is provided, any organization using vulnerable \u003ccode\u003enext-auth\u003c/code\u003e versions with the described access pattern is at risk, particularly those with dynamic deployment environments where configuration changes are frequent.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003enext-auth\u003c/code\u003e to the patched version (\u003ccode\u003enext-auth@beta\u003c/code\u003e or later stable release) immediately to ensure configuration errors fail closed.\u003c/li\u003e\n\u003cli\u003eModify existing session checks in \u003ccode\u003enext-auth\u003c/code\u003e middleware and route handlers to explicitly check for a user or session property (e.g., \u003ccode\u003e!!req.auth?.user\u003c/code\u003e) instead of just \u003ccode\u003e!!req.auth\u003c/code\u003e to prevent misconfiguration from being treated as a valid session.\u003c/li\u003e\n\u003cli\u003eImplement robust deployment pipeline checks to monitor for \u003ccode\u003e[auth][error]\u003c/code\u003e log messages from your application, treating them as critical failures to prevent misconfigured applications from reaching production environments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T14:59:25Z","date_published":"2026-07-23T14:59:25Z","id":"https://feed.craftedsignal.io/briefs/2026-07-authjs-fail-open/","summary":"A critical configuration error vulnerability in `next-auth` (Auth.js) v5 applications, specifically versions v5.0.0-beta.0 through v5.0.0-beta.31, can lead to a 'fail-open' state where server-side configuration issues cause the `auth` object to be populated with an error instead of `null`, effectively bypassing authentication checks and granting unauthorized access to protected resources.","title":"Auth.js (next-auth) v5 Configuration Error Leads to Authentication Bypass","url":"https://feed.craftedsignal.io/briefs/2026-07-authjs-fail-open/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@auth/core","next-auth"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","web-application","javascript","input-validation"],"_cs_type":"advisory","_cs_vendors":["Auth.js"],"content_html":"\u003cp\u003eA high-severity vulnerability has been identified in the \u003ccode\u003egetToken()\u003c/code\u003e helper within the \u003ccode\u003enext-auth\u003c/code\u003e and \u003ccode\u003e@auth/core\u003c/code\u003e JavaScript libraries, specifically affecting versions \u003ccode\u003e\u0026lt;= 5.0.0-beta.25\u003c/code\u003e for \u003ccode\u003enext-auth\u003c/code\u003e and \u003ccode\u003e\u0026lt; 0.41.3\u003c/code\u003e for \u003ccode\u003e@auth/core\u003c/code\u003e. This flaw, tracked as CWE-20 (Improper Input Validation), enables an unauthenticated attacker to induce a denial-of-service condition. When an application that directly calls \u003ccode\u003egetToken()\u003c/code\u003e receives a request with a malformed \u003ccode\u003eAuthorization: Bearer\u003c/code\u003e header containing invalid percent-encoding, the function attempts to URL-decode the value. This decoding step can trigger an uncaught exception if not explicitly handled by the application, causing the request handler to crash or become unresponsive. This impacts application availability, particularly in API routes, middleware, and server-side request handlers where \u003ccode\u003egetToken()\u003c/code\u003e is commonly employed, though it does not expose sensitive data or bypass authentication.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker crafts an HTTP request targeting a web application that uses the vulnerable \u003ccode\u003egetToken()\u003c/code\u003e helper.\u003c/li\u003e\n\u003cli\u003eThe attacker includes a malformed \u003ccode\u003eAuthorization: Bearer\u003c/code\u003e header in the request, where the bearer token portion contains invalid percent-encoding (e.g., \u003ccode\u003e%xx\u003c/code\u003e where \u003ccode\u003exx\u003c/code\u003e is not a valid hexadecimal character).\u003c/li\u003e\n\u003cli\u003eThe web application's API route, middleware, or server-side request handler receives the malicious request and calls the \u003ccode\u003egetToken()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003egetToken()\u003c/code\u003e function, in the absence of a session cookie, attempts to URL-decode the malformed bearer value from the \u003ccode\u003eAuthorization\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003eDue to the invalid percent-encoding, the URL-decoding process fails and throws an uncaught exception within the \u003ccode\u003egetToken()\u003c/code\u003e helper.\u003c/li\u003e\n\u003cli\u003eUnless the application has a specific \u003ccode\u003etry/catch\u003c/code\u003e block surrounding the \u003ccode\u003egetToken()\u003c/code\u003e call, this uncaught exception propagates, leading to the crash or unresponsiveness of the request handler.\u003c/li\u003e\n\u003cli\u003eThe application experiences a denial-of-service condition for that specific request, impacting availability.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of this vulnerability is a denial of service (DoS). An unauthenticated request containing a specially crafted, malformed \u003ccode\u003eAuthorization: Bearer\u003c/code\u003e header can cause an unhandled exception in any application handler that invokes the \u003ccode\u003egetToken()\u003c/code\u003e function directly. This results in the affected request failing to complete, rendering the specific endpoint unavailable for that transaction. The impact is isolated to individual requests and primarily affects application availability. It does not lead to the exposure of tokens, session data, or other sensitive information, nor does it bypass existing authentication mechanisms. The vulnerability is categorized under CWE-20: Improper Input Validation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003enext-auth\u003c/code\u003e to a patched version greater than \u003ccode\u003e5.0.0-beta.31\u003c/code\u003e or \u003ccode\u003e4.24.14\u003c/code\u003e (or \u003ccode\u003e@auth/core\u003c/code\u003e to \u003ccode\u003e0.41.3\u003c/code\u003e or newer) to automatically address the vulnerability.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not possible, implement a \u003ccode\u003etry/catch\u003c/code\u003e block around all calls to \u003ccode\u003egetToken()\u003c/code\u003e within your application code to handle potential exceptions gracefully and treat them as an invalid token.\u003c/li\u003e\n\u003cli\u003eConsider deploying an edge proxy or middleware to strip or normalize incoming \u003ccode\u003eAuthorization\u003c/code\u003e headers with malformed percent-encoding before they reach the application.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T14:45:37Z","date_published":"2026-07-23T14:45:37Z","id":"https://feed.craftedsignal.io/briefs/2026-07-authjs-dos/","summary":"A vulnerability in the Auth.js `getToken()` helper function (next-auth and @auth/core) allows unauthenticated attackers to trigger an uncaught exception via a malformed `Authorization: Bearer` header, leading to a per-request denial of service in affected applications.","title":"Auth.js getToken() Vulnerability Leads to Denial of Service","url":"https://feed.craftedsignal.io/briefs/2026-07-authjs-dos/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["next-auth (\u003e= 4.0.0, \u003c 4.24.14)","next-auth (\u003e= 4.10.3, \u003c 4.24.15)","next-auth (\u003e= 5.0.0-beta.1, \u003c= 5.0.0-beta.31)","@auth/core (\u003e= 0.1.0, \u003c 0.41.3)"],"_cs_severities":["critical"],"_cs_tags":["account-takeover","authentication-bypass","web-vulnerability","magic-link","unicode-normalization"],"_cs_type":"advisory","_cs_vendors":["Auth.js"],"content_html":"\u003cp\u003eA critical vulnerability exists in Auth.js, specifically affecting \u003ccode\u003enext-auth\u003c/code\u003e versions \u003ccode\u003e\u0026gt;= 4.0.0, \u0026lt; 4.24.14\u003c/code\u003e, \u003ccode\u003e\u0026gt;= 4.10.3, \u0026lt; 4.24.15\u003c/code\u003e, \u003ccode\u003e\u0026gt;= 5.0.0-beta.1, \u0026lt;= 5.0.0-beta.31\u003c/code\u003e and \u003ccode\u003e@auth/core\u003c/code\u003e versions \u003ccode\u003e\u0026gt;= 0.1.0, \u0026lt; 0.41.3\u003c/code\u003e, when using the default email/magic-link sign-in provider. The flaw stems from the email normalizer validating an address \u003cem\u003ebefore\u003c/em\u003e applying Unicode normalization (NFKC/NFKD). This allows an attacker to craft an email address containing a Unicode character that is not an ASCII \u003ccode\u003e@\u003c/code\u003e (U+0040) but canonicalizes to one after normalization. This bypasses the normalizer's single-\u003ccode\u003e@\u003c/code\u003e check, causing a downstream mail library that performs Unicode normalization to interpret the address with two \u003ccode\u003e@\u003c/code\u003e separators. Consequently, the passwordless sign-in link is misrouted to an attacker-controlled mailbox, enabling account takeover without requiring any victim interaction.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a target's email address and crafts a malicious version by inserting a Unicode homoglyph character that resembles '@' (e.g., \u003ccode\u003evictim_email[U+XXXX]attacker.com\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker submits this crafted email address to the vulnerable Auth.js application's magic-link sign-in flow.\u003c/li\u003e\n\u003cli\u003eThe application's default \u003ccode\u003enormalizeIdentifier\u003c/code\u003e function validates the address, incorrectly perceiving only one '@' symbol because validation occurs prior to Unicode normalization.\u003c/li\u003e\n\u003cli\u003eThe application proceeds to send the magic-link email, with the crafted address passed to a downstream mail library or service.\u003c/li\u003e\n\u003cli\u003eThe mail library or service, which performs Unicode normalization (e.g., NFKC) for internationalized email, processes the recipient address.\u003c/li\u003e\n\u003cli\u003eDuring normalization, the homoglyph character in the crafted email canonicalizes to a second '@' symbol (e.g., \u003ccode\u003evictim_email@attacker.com\u003c/code\u003e), causing the mail service to misroute the magic link.\u003c/li\u003e\n\u003cli\u003eThe magic link is delivered to the attacker-controlled mailbox, enabling the attacker to authenticate and gain unauthorized access to the victim's account.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of this vulnerability is account takeover. An attacker who knows a victim's email address can exploit this flaw to request a magic link that is subsequently delivered to an attacker-controlled mailbox. The attacker can then use this link to sign in as the victim, gaining full access to their account. No victim interaction is required for the link to be misrouted, as the attacker initiates and directly receives the authentication link. This can lead to unauthorized access to personal data, financial information, or sensitive corporate resources, depending on the scope and permissions of the compromised account.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003enext-auth\u003c/code\u003e to a patched version (currently pending, refer to GHSA-7rqj-j65f-68wh for updates) immediately.\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@auth/core\u003c/code\u003e to a patched version (currently pending, refer to GHSA-7rqj-j65f-68wh for updates) immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not possible, implement a custom \u003ccode\u003enormalizeIdentifier\u003c/code\u003e on the email provider that calls \u003ccode\u003eidentifier.normalize(\u0026quot;NFKC\u0026quot;)\u003c/code\u003e \u003cem\u003ebefore\u003c/em\u003e any validation, and ensures only one '@' remains after normalization, as detailed in the GHSA advisory.\u003c/li\u003e\n\u003cli\u003eAlternatively, as a workaround, reject any email addresses containing non-ASCII characters if your user base does not require internationalized email addresses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T14:42:37Z","date_published":"2026-07-23T14:42:37Z","id":"https://feed.craftedsignal.io/briefs/2026-07-authjs-homoglyph-bypass/","summary":"A critical vulnerability in Auth.js libraries (next-auth and @auth/core) affects the email/magic-link sign-in flow, allowing an attacker to craft an email address with a homoglyph character that bypasses validation before Unicode normalization, leading to magic links being misrouted to attacker-controlled mailboxes and enabling account takeover without victim interaction.","title":"Auth.js Email Normalizer Vulnerability Allows Homoglyph Bypass Leading to Account Takeover","url":"https://feed.craftedsignal.io/briefs/2026-07-authjs-homoglyph-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Auth.js","version":"https://jsonfeed.org/version/1.1"}