DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-8FPG-XM3F-6CX3: GHSA-8FPG-XM3F-6CX3: Authentication Fail-Open via Unvalidated Server Responses in Auth.js

#security #cve #cybersecurity #ghsa

GHSA-8FPG-XM3F-6CX3: Authentication Fail-Open via Unvalidated Server Responses in Auth.js

Vulnerability ID: GHSA-8FPG-XM3F-6CX3
CVSS Score: 7.4
Published: 2026-07-23

In Auth.js (specifically next-auth version 5), server-side configuration errors or backend exceptions can cause existence-based authentication and authorization checks to fail open. When the underlying core engine (@auth/core) encounters a configuration error or runtime exception, it returns an HTTP 500 Internal Server Error response containing a JSON-formatted error description payload. Prior to the fix, the next-auth wrappers read this response body using response.json() without validating the HTTP status code. Because any parsed JavaScript object evaluates to truthy, common existence-based checks incorrectly evaluated to true, letting unauthenticated requests pass.

TL;DR

A failure to validate HTTP response status codes in the next-auth client wrapper allows unauthenticated remote requests to bypass access controls. When backend errors trigger an HTTP 500 response, the parsed JSON error body is evaluated as a valid user session, causing existence-based security checks to fail open.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-636: Not Failing Closed
  • Attack Vector: Network
  • CVSS v3.1 Score: 7.4 (High)
  • Impact Type: Authentication Bypass
  • Exploit Status: Proof-of-Concept / Functional
  • CISA KEV Status: Not Listed

Affected Systems

  • Next.js applications using Auth.js / next-auth version 5 beta integrations
  • Server-side environments using next-auth middleware routes with existence checks
  • next-auth: >= 5.0.0-beta.0, < 5.0.0-beta.32 (Fixed in: 5.0.0-beta.32)

Code Analysis

Commit: d008b9b

Fix: prevent fail-open in next-auth client wrapper when @auth/core returns error payload

Mitigation Strategies

  • Upgrade the next-auth library to version 5.0.0-beta.32 or newer to ensure status code validation is applied on session requests.
  • Implement defensive schema validation on parsed session objects rather than relying on simple existence or truthiness checks.
  • Configure reverse proxies to drop or securely handle upstream 5xx responses without converting them into 200 OK custom pages.

Remediation Steps:

  1. Identify vulnerable dependencies by running 'npm list next-auth' in the project directory.
  2. Update the package by executing 'npm install next-auth@5.0.0-beta.32' or the equivalent command for your package manager.
  3. Audit your application's middleware and routing files to locate and modify instances of unstructured 'if (session)' checks.

References

Read the full report for GHSA-8FPG-XM3F-6CX3 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)