NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-248.
Summary
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextauthjs | next-auth | 4.0.6 – 4.24.14; 5.0.0-beta.0 – 5.0.0-beta.31 | — | No fix listed | CNA |
| @auth | core | 0.1.0 to before 0.41.3 | 0.41.3 | Patch available | CNA |
| — | @auth/core (npm) | 0.1.0 to before 0.41.3 | 0.41.3 | Patch available | GHSA-xmf8-cvqr-rfgj |
| — | next-auth (npm) | 5.0.0-beta.0 to before 5.0.0-beta.32 | 5.0.0-beta.32 | Patch available | GHSA-xmf8-cvqr-rfgj |
| — | next-auth (npm) | 4.0.6 to before 4.24.15 | 4.24.15 | Patch available | GHSA-xmf8-cvqr-rfgj |
- next-auth Vendornextauthjs Affected 4.0.6 – 4.24.14; 5.0.0-beta.0 – 5.0.0-beta.31 Fixed in — No fix listed CNA
- core Vendor@auth Affected 0.1.0 to before 0.41.3 Fixed in 0.41.3 Patch available CNA
- @auth/core (npm) Vendor— Affected 0.1.0 to before 0.41.3 Fixed in 0.41.3 Patch available GHSA-xmf8-cvqr-rfgj
- next-auth (npm) Vendor— Affected 5.0.0-beta.0 to before 5.0.0-beta.32 Fixed in 5.0.0-beta.32 Patch available GHSA-xmf8-cvqr-rfgj
- next-auth (npm) Vendor— Affected 4.0.6 to before 4.24.15 Fixed in 4.24.15 Patch available GHSA-xmf8-cvqr-rfgj
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextauth.js:next-auth:*:*:*:*:*:*:*:* | — | — | nextauthjs |
- cpe:2.3:a:nextauth.js:next-auth:*:*:*:*:*:*:*:* Versions — — ·nextauthjs
Remediation
- Fix · CNA core (@auth) Fixed in 0.41.3
- Fix · GHSA-xmf8-cvqr-rfgj @auth/core (npm) Fixed in 0.41.3 Advisory →
- Fix · GHSA-xmf8-cvqr-rfgj next-auth (npm) Fixed in 5.0.0-beta.32 Advisory →
- Fix · GHSA-xmf8-cvqr-rfgj next-auth (npm) Fixed in 4.24.15 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73418
- 2026-10-03 Alias added: GHSA-xmf8-cvqr-rfgj
References
Other 12
- https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xmf8-cvqr-rfgj
- https://github.com/nextauthjs/next-auth/pull/13469
- https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05
- https://github.com/nextauthjs/next-auth/commit/e707770f00c52b3479e43422b0200b059149ed53
- https://github.com/nextauthjs/next-auth/releases/tag/%40auth%2Fcore%400.41.3
- https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.24.15
- https://github.com/nextauthjs/next-auth/releases/tag/next-auth%405.0.0-beta.32
- https://github.com/nextauthjs/next-auth/pull/13467
- https://github.com/nextauthjs/next-auth
- https://github.com/nextauthjs/next-auth/releases/tag/@auth/[email protected]
- https://github.com/nextauthjs/next-auth/releases/tag/[email protected]
- https://github.com/nextauthjs/next-auth/releases/tag/[email protected]
More nextauthjs vulnerabilities
- TI-2022-13171 Improper handling of email input in next-auth CVSS 3.1HIGH 7.1
- TI-2022-16351 Verification requests (magic link) sent to unwanted emails CVSS 3.1CRITICAL 9.1
- TI-2026-51538 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass CVSS 4.0CRITICAL 9.1
- TI-2026-51539 Improper authorization in nextauthjs next-auth CVSS 4.0CRITICAL 9.1
- TI-2022-13137 Improper Handling of `callbackUrl` parameter in next-auth CVSS 3.1HIGH 7.5
- TI-2023-12218 Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth CVSS 3.1HIGH 8.8
Sources
- CVE-2026-73418 · CVE Program
- CVE-2026-73418 · NVD
- FIRST EPSS
- GHSA-xmf8-cvqr-rfgj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences