The vulnerability causes the exported getToken() helper in NextAuth.js to throw an uncaught exception when processing a malformed Authorization: Bearer header. This occurs because a malformed percent encoding triggers JavaScript's decodeURIComponent to error instead of treating the token as invalid. The resulting exception propagates to API routes, middleware or server‑side request handlers, resulting in a per‑request denial of service without leaking any sensitive data.

Vulnerable versions of @auth/core up to 0.41.2 and next‑auth before 4.24.15 or 5.0.0‑beta.32 are affected. The issue applies to any Next.js application that utilizes the getToken() helper for authentication, typically within API routes, middleware or server‑side rendering logic.

With a CVSS score of 7.5 the issue is classified as high severity, and the EPSS score is not available, indicating low publicly reported exploitation activity. The vulnerability is not listed in CISA KEV. An attacker with network access can craft an HTTP request containing a malformed Bearer token to trigger the exception, which can be performed remotely and without needing a valid session or authentication.