{"action":"Upgrade next-auth to 5.0.0-beta.32 or later.","affected":[{"fixed":"5.0.0-beta.32","introduced":"5.0.0-beta.0"}],"component":"next-auth","cve_ids":["CVE-2026-73421"],"ecosystem":"npm","epss":0.00643,"exploited":false,"fixed_versions":["5.0.0-beta.32"],"ghsa_id":"GHSA-8fpg-xm3f-6cx3","id":"tcs_01M5KFCRAH4NWA9WHRAVTVGTKX","modified_at":"2026-08-12T20:56:01.891204Z","published_at":"2026-07-23T14:52:23Z","references":["https://osv.dev/vulnerability/GHSA-8fpg-xm3f-6cx3","https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3","https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f","https://github.com/nextauthjs/next-auth","https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-8fpg-xm3f-6cx3","url":"https://osv.dev/vulnerability/GHSA-8fpg-xm3f-6cx3"}],"summary":"Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)"}