GHSA-8fpg-xm3f-6cx3 Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
Impact`next-auth` (Auth.js) v5 applications that gate access by checking only for the **existence** of the `auth` object — the pattern shown in the official [session management / protecting resources guide](https://authjs.dev/getting-started/session-management/protecting) — are affected.When the Auth.js configuration produces a server-side error, the `auth` object exposed by the `auth()` wrapper (in middleware, Route Handlers, etc.) is **populated with an error object instead of being `null`**:Because this object is truthy, any authorization check of the form `!!auth` (or `if (req.auth)`) evaluates to `true` for **every** request, including unauthenticated ones. The application *fails open*: instead of denying access when the auth layer is broken, it grants access to everyone.A representative trigger is a provider that is missing required configuration. For example, a Keycloak provider with neither `issuer` nor `authorization` endpoint set logs:…and from that point on `auth` is the error object above, so `!!auth` is permanently `true`. The same fail-open behavior occurs for other server-configuration errors (for example, an unset `AUTH_SECRET`).There is **no impact while the configuration is valid**. The risk materializes when a previously-working deployment becomes misconfigured — e.g. an environment variable is changed or removed during a deploy — at which point existence-based auth checks silently stop protecting routes and all visitors are treated as authenticated. Because the failure mode is silent and grants access to everyone, the consequences can be severe.This is an instance of CWE-636 (Not Failing Securely / "Failing Open") leading to improper authorization (CWE-285).PatchesThe fix ensures that a server-configuration error no longer surfaces as a truthy `auth` object: existence checks fail **closed** rather than open. This is released in `next-auth@<!-- TODO: set patched version on publish -->`.To upgrade:WorkaroundsIf you cannot upgrade immediately, check for a concrete user/session property rather than the bare object, so a configuration-error object is not treated as an authenticated session:As defense in depth, make Auth.js configuration errors fail loudly in your deployment pipeline (for example, treat `[auth][error]` log lines as a failed health check) so a broken configuration cannot silently reach production. As always, an existing session indicates authentication only — for authorization, perform an explicit role/permission check rather than relying on session existence. See the [role-based access control guide](https://authjs.dev/guides/role-based-access-control).ReferencesProtecting resources / session management: https://authjs.dev/getting-started/session-management/protectingRole-based access control (RBAC): https://authjs.dev/guides/role-based-access-controlAuth.js error reference: https://authjs.dev/reference/core/errorsFor more informationIf you have any concerns, Auth.js requests responsible disclosure, outlined here: https://authjs.dev/securityCreditsReported by @marc-zollingkoffer-syzygy.
CVSS v4.0 score: 9.1