This vulnerability allows an attacker to craft query parameters that alter the dynamic route value recognized by the page while preserving the visible path. The result is an authorization bypass: protected content can be rendered when the expected middleware check is skipped. Because of this, sensitive information can be exposed without proper authentication. The flaw is classified as CWE-288, an authorization bypass through privilege escalation scenario.

Applications built with Vercel's Next.js library from versions 15.4.0 up to, but not including, 15.5.16, and from 16.2.5 and earlier, are affected. The vulnerability has been resolved in Next.js 15.5.16 and 16.2.5. Any deployment using a vulnerable range of versions should be considered at risk.

The CVSS base score of 8.1 indicates high severity, but the EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw via HTTP requests with crafted query strings, so the attack vector is likely remote over the web. Because the flaw can be triggered by a simple URL manipulation, many attackers could potentially take advantage, especially if the application exposes sensitive dynamic routes. Administrators should treat this as a high‑risk issue and prioritize remediation accordingly.