01 Record

CVE-2026-73421

NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

CriticalPUBLISHEDCNA: GitHub_M

Base score9.1 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

02 Description

NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Published: 2026-08-13 22:04Z20 HR AGO
Last updated: 2026-08-13 22:04Z20 HR AGO
Reserved: 2026-08-12
Assigning CNA: GitHub_M
Record state: PUBLISHED
Severity: Critical (CVSS 9.1)
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses: CWE-285 CWE-636
SSVC decision: No CISA-ADP assessment
Data version: 5.2
Document digest: 37b0bf7fd6abab0c2f6c7154670f96063f24f78b85105f7de7b0fc76720e0346

VendorProductVersionsPlatforms

nextauthjsnext-auth>= 5.0.0-beta.4, < 5.0.0-beta.32—