« Volver al listado

CVE-2026-73418

Estado: Pendiente de análisisAlta (7.5)—

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid.

Leer descripción completaMostrar menos

Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso de red sin autenticación (AV:N/PR:N/UI:N) enviando headers malformados. El ataque causa DoS por excepción no capturada en rutas API (T1499.004: application exhaustion).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Nextauth — @auth/coreAINextauth.js — Next-authAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-73418",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73418",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-13T12:53:20.378207Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "nextauthjs",
          "product": "next-auth",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.0.6, <= 4.24.14"
            },
            {
              "status": "affected",
              "version": ">= 5.0.0-beta.0, <= 5.0.0-beta.31"
            }
          ]
        },
        {
          "vendor": "@auth",
          "product": "core",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.1.0, < 0.41.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-08-12T21:17:40.890",
  "references": [
    {
      "url": "https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextauthjs/next-auth/commit/e707770f00c52b3479e43422b0200b059149ed53",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextauthjs/next-auth/pull/13469",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextauthjs/next-auth/releases/tag/%40auth%2Fcore%400.41.3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.24.15",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextauthjs/next-auth/releases/tag/next-auth%405.0.0-beta.32",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xmf8-cvqr-rfgj",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-248"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32."
    }
  ],
  "lastModified": "2026-09-09T20:58:37.713",
  "sourceIdentifier": "security-advisories@github.com"
}