GHSA-8FPG-XM3F-6CX3

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

// middleware.ts
export default auth((req) => {
  // `auth.user` is only present on a real session; resilient to config-error objects
  const isLoggedIn = !!req.auth?.user
  // ...
})

next-auth (Auth.js) v5 applications that gate access by checking only for the existence of the auth object, the pattern shown in the official session management / protecting resources guide, are affected.

When the Auth.js configuration produces a server-side error, the auth object exposed by the auth() wrapper (in middleware, Route Handlers, etc.) is populated with an error object instead of being null:

{ "message": "There was a problem with the server configuration. Check the server logs for more information." }

Because this object is truthy, any authorization check of the form !!auth (or if (req.auth)) evaluates to true for every request, including unauthenticated ones. The application fails open: instead of denying access when the auth layer is broken, it grants access to everyone.

// middleware.ts, affected pattern
export default auth((req) => {
  const { nextUrl, auth } = req
  const isLoggedIn = !!auth // <-- always true when the configuration is broken
  // ...
})

A representative trigger is a provider that is missing required configuration. For example, a Keycloak provider with neither issuer nor authorization endpoint set logs:

[auth][error] InvalidEndpoints: Provider "keycloak" is missing both `issuer` and `authorization` endpoint config. At least one of them is required.

…and from that point on auth is the error object above, so !!auth is permanently true. The same fail-open behavior occurs for other server-configuration errors (for example, an unset AUTH_SECRET).

There is no impact while the configuration is valid. The risk materializes when a previously-working deployment becomes misconfigured, e.g. an environment variable is changed or removed during a deploy, at which point existence-based auth checks silently stop protecting routes and all visitors are treated as authenticated. Because the failure mode is silent and grants access to everyone, the consequences can be severe.

This is an instance of CWE-636 (Not Failing Securely / "Failing Open") leading to improper authorization (CWE-285).

Kodem intelligence

Already deployed Kodem?

The fix ensures that a server-configuration error no longer surfaces as a truthy auth object: existence checks fail closed rather than open. This is released in next-auth@<!-- TODO: set patched version on publish -->.

To upgrade:

npm i next-auth@beta

yarn add next-auth@beta

pnpm add next-auth@beta

1. What is GHSA-8FPG-XM3F-6CX3? GHSA-8FPG-XM3F-6CX3 is a critical-severity security vulnerability in next-auth (npm), affecting versions >= 5.0.0-beta.0, <= 5.0.0-beta.31. It is fixed in 5.0.0-beta.32.
2. Which versions of next-auth are affected by GHSA-8FPG-XM3F-6CX3? next-auth (npm) versions >= 5.0.0-beta.0, <= 5.0.0-beta.31 is affected.
3. Is there a fix for GHSA-8FPG-XM3F-6CX3? Yes. GHSA-8FPG-XM3F-6CX3 is fixed in 5.0.0-beta.32. Upgrade to this version or later.
4. Is GHSA-8FPG-XM3F-6CX3 exploitable, and should I be worried? Whether GHSA-8FPG-XM3F-6CX3 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-8FPG-XM3F-6CX3 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-8FPG-XM3F-6CX3? Upgrade next-auth to 5.0.0-beta.32 or later.

Other vulnerabilities in next-auth