Security readout for executives and security teams
Plain-English summary
A server configuration error can make NextAuth.js report an error object where an application expects no authenticated session. Because that object is truthy, applications checking only whether authentication data exists may admit unauthenticated visitors. Correctly configured deployments are unaffected, but a later configuration mistake can silently expose protected routes.
Executive priority
Treat this as an urgent authentication-control issue for organizations using NextAuth.js v5 betas. Identify affected deployments and upgrade promptly, prioritizing internet-facing or sensitive applications. Because exploitation depends on misconfiguration, current correct behavior does not remove future exposure after configuration drift or deployment mistakes.
Technical view
Affected NextAuth.js v5 beta releases can parse a non-OK session response into a truthy error object rather than null. Existence-based authorization checks in middleware, Route Handlers, React Server Components, and other auth() entry points may consequently fail open. Missing AUTH_SECRET values, invalid provider endpoints, or other server configuration errors can trigger the condition. Version 5.0.0-beta.32 fixes it.
Likely exposure
Exposure requires an affected NextAuth.js beta, an auth() access gate based only on object existence, and a server configuration error. Internet-facing protected routes have the greatest business risk. The source bundle conflicts on the starting version: its narrative says beta.0, while its affected-version record begins at beta.4.
Exploitation context
The flaw is remotely reachable, requires no privileges or user interaction, and can expose confidentiality and integrity when the triggering configuration state exists. The supplied record is not in KEV and provides no evidence of active exploitation. Exploit prevalence is therefore unknown.
Researcher notes
The core failure is improper authorization following exceptional session handling, aligning with CWE-285 and CWE-636. Review should distinguish authentication errors from valid session objects at every auth() boundary. The supplied sources disagree whether exposure starts at beta.0 or beta.4; use the vendor advisory and package history to resolve inventory decisions conservatively.
Mitigation direction
- Upgrade next-auth to version 5.0.0-beta.32 or a later vendor-supported release.
- Audit authorization gates and reject requests unless a valid authenticated session or expected user identity is present.
- Verify AUTH_SECRET and provider issuer or authorization endpoint settings across every deployed environment.
- Check vendor guidance and release notes before applying changes in production.
Validation and detection
- Inventory next-auth versions, treating pre-beta.32 deployments as candidates pending resolution of the version-range discrepancy.
- Review middleware, Route Handlers, Server Components, and other auth() consumers for existence-only checks.
- In a safe test environment, confirm configuration failures deny unauthenticated requests to every protected route.
- Test that non-OK session responses cannot produce authorization-granting objects.
- Confirm deployed secrets and provider endpoint configuration are present and valid.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-285: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-636: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-73421 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
9.1CriticalVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8fCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authorization
Improper Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Not Failing Securely
Not Failing Securely represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.