These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-73421 is a critical vulnerability in NextAuth.js, a popular authentication library for Next.js. The issue allows applications to fail open when Auth.js has a server configuration error, potentially granting unauthorized access to protected routes. This problem exists in versions 5.0.0-beta.0 through 5.0.0-beta.32 and is fixed in version 5.0.0-beta.32.
A vulnerability in NextAuth.js can cause an unhandled exception when reading a malformed Authorization: Bearer header, potentially leading to a denial of service. This issue arises from the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeU [truncated]