What is CVE-2026-73421?
CVE-2026-73421 affects NextAuth.js beta versions up to 5.0.0-beta.32. Applications checking only for the existence of the auth object may fail open during server config errors, allowing unauthorized access. Developers must verify user session validity explicitly.
Azərbaycanca: CVE-2026-73421 NextAuth.js-in beta versiyalarında aşkarlanıb. Tətbiqlər yalnız auth() obyektinin mövcudluğunu yoxlayarsa, server konfiqurasiya xətası zamanı giriş mühafizəsi deaktiv ola bilər. Tərtibatçılar auth() nəticəsində istifadəçi sessiyasının etibarlılığını əlavə yoxlamalıdır.
Related CVEs
link basis: same weakness class CWE-284
FAQ2
Under what conditions can CVE-2026-73421 lead to unauthorized access?
If the application only checks for the existence of the auth() object and a server configuration error occurs, access protection may be disabled.
What should developers do to mitigate CVE-2026-73421?
Developers must explicitly verify the validity of the user session in the auth() result.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.