CVE-2026-73418: @auth/core GetToken() Throws An Uncaught Exception Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xmf8-cvqr-rfgj",
  "modified" : "2026-08-13T19:05:18Z",
  "published" : "2026-07-23T14:42:55Z",
  "aliases" : [ "CVE-2026-73418" ],
  "summary" : "Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers",
  "details" : "## Summary\n\nThe exported `getToken()` helper (`next-auth/jwt` and `@auth/core/jwt`) can throw an uncaught exception when it reads a malformed `Authorization: Bearer …` header. When no session cookie is present, `getToken()` URL-decodes the bearer value before validating it, and malformed percent-encoding causes the decode step to throw rather than being treated as an invalid token. Because `getToken()` is commonly called in API routes, middleware, and other request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests.\n\n## Am I affected?\n\nYou are affected if **all** of the following hold:\n\n- You use `next-auth` `<= 5.0.0-beta.25` (or `@auth/core` exposing the same `getToken()` implementation).\n- Your application calls `getToken()` directly — for example in a Route Handler, middleware, or server-side request handler.\n- You do not wrap that `getToken()` call in your own `try/catch`.\n\nYou are **not** affected if you only use the framework's `auth()` helper and never call `getToken()` yourself, or if every `getToken()` call site already has its own exception handling.\n\n## Impact\n\n- Denial of service: an unauthenticated request carrying a malformed Bearer authorization header can raise an unhandled exception in any handler that calls `getToken()`.\n- The impact is per-request and limited to availability; it does not expose tokens, sessions, or other data, and does not bypass authentication.\n\nCWE-20: Improper Input Validation.\n\n## Patched version\n\nThe fix makes `getToken()` treat a malformed Bearer value as an invalid token and return `null`, matching how other undecodable tokens are already handled. Upgrade to the first release containing this fix (to be published; this advisory will be updated with the exact patched version before publication) and no code changes are required.\n\n## Workarounds\n\nIf you cannot upgrade immediately, either:\n\n- **Config/code-level:** wrap your `getToken()` calls so a thrown error is treated as \"no token\", e.g.\n\n  ```ts\n  let token = null\n  try {\n    token = await getToken({ req, secret })\n  } catch {\n    token = null\n  }\n  ```\n\n- Or strip/normalize the incoming `Authorization` header at the edge (proxy, middleware) before it reaches `getToken()`, rejecting values whose Bearer portion is not valid percent-encoding.\n\n## Credit\n\nReported by @deprrous. Thank you for the responsible disclosure.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@auth/core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.1.0"
      }, {
        "fixed" : "0.41.3"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "next-auth"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0-beta.0"
      }, {
        "fixed" : "5.0.0-beta.32"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.0.0-beta.31"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "next-auth"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.6"
      }, {
        "fixed" : "4.24.15"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.24.14"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xmf8-cvqr-rfgj"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-73418"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nextauthjs/next-auth/pull/13467"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nextauthjs/next-auth/pull/13469"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nextauthjs/next-auth/commit/e707770f00c52b3479e43422b0200b059149ed53"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/nextauthjs/next-auth"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-23T14:42:55Z",
    "nvd_published_at" : "2026-08-12T21:17:40Z"
  }
}