Auth.js Configuration Error Allows Auth Bypass via Existence Check (CVE-2025-73421)

Vulnerability Overview Title: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error) Description: In (Auth.js) v5 applications, when access is restricted solely by checking for the existence of the object, a server-side configuration error causes the object to be populated with an error object instead of . This causes any existence checks (such as or ) to evaluate to , thereby allowing all requests to pass, including unauthenticated ones. Scope Affected Versions: >= 5.0.0-beta.0, <= 5.0.0-beta.31 Fixed Version: 5.0.0-beta.32 Severity: Low CVE ID: CVE-2025-73421 Weaknesses: CWE-285, CWE-636 Remediation 1. Upgrade: 2. Workaround: If an immediate upgrade is not possible, check specific user/session properties rather than relying on the raw object. This ensures that configuration error objects are not treated as authenticated sessions. 3. Additional Defenses: Make Auth.js configuration errors fail loudly in the deployment pipeline (e.g., treat the log line as a failed health check) so that misconfigurations do not silently reach production. Always treat existing sessions as an indicator of authentication only for authorization purposes; perform explicit role/permission checks rather than relying on session existence. POC Code References Protecting resources / session management Role-based access control (RBAC) Auth.js error reference Additional Information For any questions, we request responsible disclosure, outlined here: https://authjs.dev/vulnerability Credit Reporter: @marc-zollingkofer-szygyy

Goal Reached Thanks to every supporter — we hit 100%!

Auth.js Configuration Error Allows Auth Bypass via Existence Check (CVE-2025-73421)

More from this source