CVE Reports

Posted on Jul 23 • Originally published at cvereports.com

GHSA-XMF8-CVQR-RFGJ: GHSA-XMF8-CVQR-RFGJ: Denial of Service via Uncaught Exception and Session Confusion in Auth.js

#security #cve #cybersecurity #ghsa

GHSA-XMF8-CVQR-RFGJ: Denial of Service via Uncaught Exception and Session Confusion in Auth.js

Vulnerability ID: GHSA-XMF8-CVQR-RFGJ
CVSS Score: 7.5
Published: 2026-07-23

Auth.js (formerly NextAuth.js) contains a denial of service vulnerability due to an uncaught URIError in the getToken() token parser when processing malformed percent-encoded sequences in bearer tokens. Additionally, the library was vulnerable to session state confusion and replay attacks because OAuth check cookies (state, nonce, and PKCE) were not properly bound to specific providers, permitting cross-provider token reuse.

TL;DR

Unauthenticated attackers can crash Auth.js applications using malformed authorization headers, while logical flaws in OAuth cookie validation allow cross-provider session replay attacks.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-248 (Uncaught Exception) / CWE-384 (Session Fixation)
Attack Vector: Network
CVSS v3.1 Score: 7.5 (High)
Impact: Availability (High), Integrity (Low)
Exploit Status: poc
KEV Status: Not Listed

Affected Systems

Next.js applications using next-auth middleware or getToken() helper functions
SvelteKit, SolidStart, and Nuxt.js projects integrated with @auth/core
@auth/core: < 0.41.3 (Fixed in: 0.41.3)
next-auth (v4): < 4.24.15 (Fixed in: 4.24.15)
next-auth (v5): < 5.0.0-beta.32 (Fixed in: 5.0.0-beta.32)

Code Analysis

Commit: e707770

fix(core): trap decodeURIComponent errors in getToken helper

Commit: 5bca239

fix: bind check cookies to provider ID to mitigate reuse

Exploit Details

GitHub Security Advisory: Details regarding the proof of concept exploit and structural causes of the URIError.

Mitigation Strategies

Upgrade @auth/core to version 0.41.3 or higher.
Upgrade next-auth (v4) to version 4.24.15 or higher.
Upgrade next-auth (v5) to version 5.0.0-beta.32 or higher.
Deploy WAF rules to validate the format of the Authorization header.
Configure Nginx or reverse proxies to reject requests containing invalid percent encoding in headers.

Remediation Steps:

Identify all projects utilizing NextAuth.js or Auth.js by searching package.json files.
Run the appropriate dependency update command: npm install next-auth@4.24.15 or npm install next-auth@5.0.0-beta.32.
Verify that all transient dependencies of @auth/core are updated to version 0.41.3.
Deploy the updated application build to staging and production environments.
Perform a validation check using curl to ensure malformed bearer tokens no longer yield 500 errors.

References

Read the full report for GHSA-XMF8-CVQR-RFGJ on our website for more details including interactive diagrams and full exploit analysis.

DEV Community