GHSA-XMF8-CVQR-RFGJ: Denial of Service via Uncaught Exception and Session Confusion in Auth.js

Vulnerability ID: GHSA-XMF8-CVQR-RFGJ
CVSS Score: 7.5
Published: 2026-07-23

Auth.js (formerly NextAuth.js) contains a denial of service vulnerability due to an uncaught URIError in the getToken() token parser when processing malformed percent-encoded sequences in bearer tokens. Additionally, the library was vulnerable to session state confusion and replay attacks because OAuth check cookies (state, nonce, and PKCE) were not properly bound to specific providers, permitting cross-provider token reuse.

TL;DR

Unauthenticated attackers can crash Auth.js applications using malformed authorization headers, while logical flaws in OAuth cookie validation allow cross-provider session replay attacks.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-248 (Uncaught Exception) / CWE-384 (Session Fixation)
• Attack Vector: Network
• CVSS v3.1 Score: 7.5 (High)
• Impact: Availability (High), Integrity (Low)
• Exploit Status: poc
• KEV Status: Not Listed

Affected Systems

• Next.js applications using next-auth middleware or getToken() helper functions
• SvelteKit, SolidStart, and Nuxt.js projects integrated with @auth/core
• @auth/core: < 0.41.3 (Fixed in: 0.41.3)
• next-auth (v4): < 4.24.15 (Fixed in: 4.24.15)
• next-auth (v5): < 5.0.0-beta.32 (Fixed in: 5.0.0-beta.32)

Code Analysis

Commit: e707770

fix(core): trap decodeURIComponent errors in getToken helper

Commit: 5bca239

fix: bind check cookies to provider ID to mitigate reuse

Exploit Details

• GitHub Security Advisory: Details regarding the proof of concept exploit and structural causes of the URIError.

Mitigation Strategies

• Upgrade @auth/core to version 0.41.3 or higher.
• Upgrade next-auth (v4) to version 4.24.15 or higher.
• Upgrade next-auth (v5) to version 5.0.0-beta.32 or higher.
• Deploy WAF rules to validate the format of the Authorization header.
• Configure Nginx or reverse proxies to reject requests containing invalid percent encoding in headers.

Remediation Steps:

1. Identify all projects utilizing NextAuth.js or Auth.js by searching package.json files.
2. Run the appropriate dependency update command: npm install [email protected] or npm install [email protected].
3. Verify that all transient dependencies of @auth/core are updated to version 0.41.3.
4. Deploy the updated application build to staging and production environments.
5. Perform a validation check using curl to ensure malformed bearer tokens no longer yield 500 errors.

References

• GitHub Security Advisory GHSA-XMF8-CVQR-RFGJ
• Pull Request #13467: Fix getToken decode URIError
• Pull Request #13469: Harden OAuth check cookies

Read the full report for GHSA-XMF8-CVQR-RFGJ on our website for more details including interactive diagrams and full exploit analysis.