Not Failing Securely ('Failing Open') Affecting next-auth package, versions >=5.0.0-beta.0 <5.0.0-beta.32
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Not Failing Securely ('Failing Open') vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-NEXTAUTH-18306836
- published25 Jul 2026
- disclosed23 Jul 2026
- creditmarc-zollingkoffer-syzygy
Introduced: 23 Jul 2026
New CVE NOT AVAILABLE CWE-285 (opens in a new tab)How to fix?
Upgrade next-auth to version 5.0.0-beta.32 or higher.
Overview
next-auth is an Authentication for Next.js
Affected versions of this package are vulnerable to Not Failing Securely ('Failing Open') in the auth process. An attacker can gain unauthorized access to protected resources by triggering a server-side configuration error that causes the auth object to be populated with an error object, which is then treated as a valid session by existence-based authorization checks. This is only exploitable if the application relies solely on the existence of the auth object for access control and a server-side configuration error occurs.
Workaround
This vulnerability can be mitigated by checking for a concrete user or session property (such as auth.user) instead of relying on the existence of the auth object, and by ensuring configuration errors fail loudly in deployment pipelines.