Next.js versions >=15.2.0 <15.5.18 and >=16.0.0 <16.2.6 contain an authentication bypass vulnerability (CWE-288) due to the incomplete application of a prior fix (CVE-2026-44575) in middleware.ts when using Turbopack. This allows attackers to bypass authentication mechanisms by exploiting alternate paths or channels. The vulnerability has been addressed and fixed in versions 15.5.18 and 16.2.6. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No known exploits in the wild have been reported. The vendor advisory from Red Hat confirms the affected versions and the fix versions but does not explicitly state the remediation level. Patch status is not explicitly confirmed in the advisory, so users should verify with the vendor for current remediation guidance.

Successful exploitation of this vulnerability allows an attacker to bypass authentication controls, potentially gaining unauthorized access to protected resources or functionality within Next.js applications using affected versions. The impact is high confidentiality loss without affecting integrity or availability. This could lead to exposure of sensitive data or unauthorized actions within the application context.

The vulnerability is fixed in Next.js versions 15.5.18 and 16.2.6. Users should upgrade to these or later versions to remediate the issue. Patch status is not explicitly confirmed in the vendor advisory, so it is recommended to consult the official Next.js release notes and Red Hat advisory for the latest remediation guidance. No alternative mitigations or workarounds are specified in the advisory.