NextAuth.js, an authentication library for Next.js, has a critical improper authorization vulnerability (CWE-285) in versions 5.0.0-beta.0 through 5.0.0-beta.31. The vulnerability arises when server configuration errors cause the auth() wrapper to return a truthy error object instead of null for unauthenticated requests. Consequently, authorization checks that only verify the presence of the auth object (e.g., !!auth or if (req.auth)) mistakenly grant access to unauthenticated users. This can occur if a provider lacks both issuer and authorization endpoints or if the AUTH_SECRET environment variable is unset. The vulnerability is resolved in next-auth 5.0.0-beta.32.

If the server configuration is invalid or misconfigured, routes protected solely by the existence of a session or auth object will grant access to all visitors, including unauthenticated users. This results in unauthorized access to protected resources. There is no impact when the configuration is valid. No known exploits in the wild have been reported.

Upgrade to next-auth version 5.0.0-beta.32 or later, where this issue is fixed. Ensure that server configuration is valid, including setting the AUTH_SECRET and correctly configuring provider endpoints. Avoid relying solely on the existence of the auth object for authorization checks, and implement more robust validation of session status.