Improper Check for Unusual or Exceptional Conditions Affecting @auth/core package, versions >=0.1.0 <0.41.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-AUTHCORE-18306960
- published25 Jul 2026
- disclosed23 Jul 2026
- creditdeprrous
Introduced: 23 Jul 2026
New CVE NOT AVAILABLE CWE-754 (opens in a new tab)How to fix?
Upgrade @auth/core to version 0.41.3 or higher.
Overview
@auth/core is an Authentication for the Web.
Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the getToken function. An attacker can cause the application to throw an unhandled exception and disrupt service availability by sending a malformed Bearer authorization header to endpoints that directly invoke this function without proper exception handling.
Workaround
This vulnerability can be mitigated by wrapping calls to getToken in a try/catch block to handle exceptions, or by normalizing or rejecting malformed Authorization headers before they reach the function.