{"id":"CVE-2026-73418","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-73418","summary":"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers","details":"## Summary\n\nThe exported `getToken()` helper (`next-auth/jwt` and `@auth/core/jwt`) can throw an uncaught exception when it reads a malformed `Authorization: Bearer …` header. When no session cookie is present, `getToken()` URL-decodes the bearer value before validating it, and malformed percent-encoding causes the decode step to throw rather than being treated as an invalid token. Because `getToken()` is commonly called in API routes, middleware, and other request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests.\n\n## Am I affected?\n\nYou are affected if **all** of the following hold:\n\n- You use `next-auth` `<= 5.0.0-beta.25` (or `@auth/core` exposing the same `getToken()` implementation).\n- Your application calls `getToken()` directly — for example in a Route Handler, middleware, or server-side request handler.\n- You do not wrap that `getToken()` call in your own `try/catch`.\n\nYou are **not** affected if you only use the framework's `auth()` helper and never call `getToken()` yourself, or if every `getToken()` call site already has its own exception handling.\n\n## Impact\n\n- Denial of service: an unauthenticated request carrying a malformed Bearer authorization header can raise an unhandled exception in any handler that calls `getToken()`.\n- The impact is per-request and limited to availability; it does not expose tokens, sessions, or other data, and does not bypass authentication.\n\nCWE-20: Improper Input Validation.\n\n## Patched version\n\nThe fix makes `getToken()` treat a malformed Bearer value as an invalid token and return `null`, matching how other undecodable tokens are already handled. Upgrade to the first release containing this fix (to be published; this advisory will be updated with the exact patched version before publication) and no code changes are required.\n\n## Workarounds\n\nIf you cannot upgrade immediately, either:\n\n- **Config/code-level:** wrap your `getToken()` calls so a thrown error is treated as \"no token\", e.g.\n\n  ```ts\n  let token = null\n  try {\n    token = await getToken({ req, secret })\n  } catch {\n    token = null\n  }\n  ```\n\n- Or strip/normalize the incoming `Authorization` header at the edge (proxy, middleware) before it reaches `getToken()`, rejecting values whose Bearer portion is not valid percent-encoding.\n\n## Credit\n\nReported by @deprrous. Thank you for the responsible disclosure.","published":"2026-07-23T14:42:55Z","modified":"2026-08-12T20:30:06.785185495Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@auth/core","fixedVersion":"0.41.3"},{"ecosystem":"npm","name":"next-auth","fixedVersion":"5.0.0-beta.32"},{"ecosystem":"npm","name":"next-auth","fixedVersion":"4.24.15"}],"fix":{"url":"https://github.com/nextauthjs/next-auth/pull/13467","label":"nextauthjs/next-auth#13467"},"references":[{"type":"WEB","url":"https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xmf8-cvqr-rfgj"},{"type":"WEB","url":"https://github.com/nextauthjs/next-auth/pull/13467"},{"type":"WEB","url":"https://github.com/nextauthjs/next-auth/pull/13469"},{"type":"WEB","url":"https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05"},{"type":"WEB","url":"https://github.com/nextauthjs/next-auth/commit/e707770f00c52b3479e43422b0200b059149ed53"},{"type":"PACKAGE","url":"https://github.com/nextauthjs/next-auth"},{"type":"WEB","url":"https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3"},{"type":"WEB","url":"https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15"},{"type":"WEB","url":"https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T20:30:06.785185495Z"}}