CVE-2026-73421 nextauthjs CVE debrief

Who should care

Defenders responsible for Next.js applications using NextAuth.js should assess their configurations and upgrade to prevent potential unauthorized access. They should also review protected routes for unauthorized access and verify their NextAuth.js configuration for potential server errors.

Why it matters

CVE-2026-73421 is a critical vulnerability in NextAuth.js that allows unauthorized access due to server configuration errors. Defenders should verify their configurations and upgrade to prevent potential breaches.

• Potential unauthorized access to protected routes.
• Need to verify NextAuth.js configuration.
• Priority to upgrade to version 5.0.0-beta.32 or later.

Technical summary

The vulnerability exists in NextAuth.js versions 5.0.0-beta.0 through 5.0.0-beta.32. It causes applications to fail open when Auth.js has a server configuration error, allowing unauthorized access to protected routes. The issue is fixed in version 5.0.0-beta.32. Affected product deployments should be reviewed for potential unauthorized access, and defenders should prioritize verifying their NextAuth.js configuration and upgrading to version 5.0.0-beta.32 or later to prevent potential unauthorized access. This vulnerability has a CVSS score of 9.1 and a CRITICAL severity rating.

Defensive priority

Defenders should prioritize verifying their NextAuth.js configuration and upgrading to version 5.0.0-beta.32 or later to prevent potential unauthorized access.

Recommended defensive actions

• Verify NextAuth.js configuration for potential server errors.
• Upgrade to version 5.0.0-beta.32 or later.
• Review protected routes for unauthorized access.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its existence in specific versions of NextAuth.js and the fix in version 5.0.0-beta.32. Affected deployments should verify their configurations and upgrade to prevent potential unauthorized access. The vulnerability allows applications to fail open when Auth.js has a server configuration error, potentially granting unauthorized access to protected routes. Defenders should review the official advisory and CVE record to validate affected scope, severity, and 3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.