A configuration error in NextAuth.js causes the auth() wrapper to return an error object instead of null when the server is misconfigured. Applications that rely solely on the truthiness of the returned auth object for access control thus treat unauthenticated requests as authenticated, allowing users to bypass protected routes. This results in unauthorized access to protected content.

The vulnerability affects the NextAuth.js library, specifically the next-auth package, in versions from 5.0.0-beta.0 through 5.0.0-beta.32. Upgrading to 5.0.0-beta.32 or a later release mitigates the issue.

The CVSS score of 9.1 indicates a high severity flaw, and the EPSS score is not available, suggesting no publicly observed exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is triggered by server configuration errors, the likely attack vector involves either accidental misconfiguration during deployment or an attacker with the ability to alter server settings. Properly configured applications are not affected, but once a deployment becomes misconfigured, routes guarded only by existence checks silently grant access to every visitor.