Answer in brief
CVE-2026-73421 records a Critical severity (CVSS 9.1) vulnerability in NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error). The current sources do not mark it as known exploited. The current feed maps nextauthjs/next-auth (generic), next-auth (npm), next-auth (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps nextauthjs/next-auth (generic), next-auth (npm), next-auth (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| nextauthjs/next-authgeneric | >=5.0.0-beta.4 <5.0.0-beta.32 | 5.0.0-beta.32 |
| next-authnpm | >=5.0.0-beta.0 <5.0.0-beta.32 | 5.0.0-beta.32 |
| next-authnpm | >=5.0.0-beta.0,<=5.0.0-beta.31 | 5.0.0-beta.32 |
Published upstream
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 8, 2026
NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.
Quoted source text, attributed separately from HOL analysis.