This vulnerability resides in the Sentry JavaScript SDK’s Next.js webpack integration. The injected code incorrectly skips application middleware for any request that matches a configured tunnelRoute. As a result, unauthenticated requests can reach routes that rely solely on middleware for authorization, exposing sensitive application behavior or data. The flaw is a classic authorization bypass (CWE‑693).

Vendor getsentry provides the Sentry JavaScript SDK for Next.js. Versions from 9.36.0 up to and including 9.47.2, as well as 10.75.2 and 11.0.0‑rc.1, contain the regression that omits middleware processing on tunneled paths. Applications integrating these SDK versions cannot rely on middleware to gate access to routes that collide with the tunnel path or dynamic segments beneath it.

The CVSS base score of 9.1 places this issue in the high severity range, although an EPSS score is not available. It is not listed as a known exploited vulnerability in the CISA KEV catalog. Exploitation requires a configured tunnelRoute, a webpack‑built application, a route that collides with the tunnel path, and middleware as the sole authorization mechanism. An attacker can send a crafted HTTP request to the tunneled route and gain unauthorized access to protected resources.