CVE-2026-73418

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.

• CWE-20
• CWE-248

• https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05
• https://github.com/nextauthjs/next-auth/commit/e707770f00c52b3479e43422b0200b059149ed53
• https://github.com/nextauthjs/next-auth/pull/13469
• https://github.com/nextauthjs/next-auth/releases/tag/%40auth%2Fcore%400.41.3
• https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.24.15
• https://github.com/nextauthjs/next-auth/releases/tag/next-auth%405.0.0-beta.32
• https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xmf8-cvqr-rfgj

Published

Aug 12, 2026

Last Modified

Aug 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73412Shescape is a simple shell escape library for JavaScript. Pr…6.3
• CVE-2026-73413Shescape is a simple shell escape library for JavaScript. Fr…8.7
• CVE-2026-73414Shescape is a simple shell escape library for JavaScript. Pr…9.2
• CVE-2026-73415jupyterlab is an extensible environment for interactive and …7.5
• CVE-2026-73416jupyterlab is an extensible environment for interactive and …6.1
• CVE-2026-73417jupyterlab is an extensible environment for interactive and …8.6
• CVE-2026-73419NextAuth.js provides authentication for Next.js. Prior to@au…6.8
• CVE-2026-7342Use after free in WebView in Google Chrome on Android prior …8.8
• CVE-2026-73420NextAuth.js provides authentication for Next.js. Prior to @a…9.1
• CVE-2026-73421NextAuth.js provides authentication for Next.js. From next-a…9.1
• CVE-2026-73422Astro is a web framework for content-driven websites. From 2…5.3
• CVE-2026-73423Astro is a web framework for content-driven websites. From 7…5.1