{"id":"GHSA-xmf8-cvqr-rfgj","title":"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers","summary":"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers","severity":"high","cvss":7.5,"cwe":["CWE-20"],"vendor":"auth","product":"@auth/core","ecosystem":"npm","affected":["@auth/core >= 0.1.0, < 0.41.3","next-auth >= 5.0.0-beta.0, <= 5.0.0-beta.31","next-auth >= 4.0.6, <= 4.24.14"],"patched":["@auth/core 0.41.3","next-auth 5.0.0-beta.32","next-auth 4.24.15"],"published":"2026-07-23","updated":"2026-07-23","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-xmf8-cvqr-rfgj","references":[{"url":"https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xmf8-cvqr-rfgj"},{"url":"https://github.com/nextauthjs/next-auth/pull/13467"},{"url":"https://github.com/nextauthjs/next-auth/pull/13469"},{"url":"https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05"},{"url":"https://github.com/nextauthjs/next-auth/commit/e707770f00c52b3479e43422b0200b059149ed53"},{"url":"https://github.com/nextauthjs/next-auth/releases/tag/@auth/core@0.41.3"},{"url":"https://github.com/nextauthjs/next-auth/releases/tag/next-auth@4.24.15"},{"url":"https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32"},{"url":"https://github.com/advisories/GHSA-xmf8-cvqr-rfgj"}],"tags":["ghsa","npm"],"ingestedAt":"2026-07-23T15:18:38.116Z","slug":"GHSA-xmf8-cvqr-rfgj","body":"## Overview\n\n## Summary\n\nThe exported `getToken()` helper (`next-auth/jwt` and `@auth/core/jwt`) can throw an uncaught exception when it reads a malformed `Authorization: Bearer …` header. When no session cookie is present, `getToken()` URL-decodes the bearer value before validating it, and malformed percent-encoding causes the decode step to throw rather than being treated as an invalid token. Because `getToken()` is commonly called in API routes, middleware, and other request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests.\n\n## Am I affected?\n\nYou are affected if **all** of the following hold:\n\n- You use `next-auth` `<= 5.0.0-beta.25` (or `@auth/core` exposing the same `getToken()` implementation).\n- Your application calls `getToken()` directly — for example in a Route Handler, middleware, or server-side request handler.\n- You do not wrap that `getToken()` call in your own `try/catch`.\n\nYou are **not** affected if you only use the framework's `auth()` helper and never call `getToken()` yourself, or if every `getToken()` call site already has its own exception handling.\n\n## Impact\n\n- Denial of service: an unauthenticated request carrying a malformed Bearer authorization header can raise an unhandled exception in any handler that calls `getToken()`.\n- The impact is per-request and limited to availability; it does not expose tokens, sessions, or other data, and does not bypass authentication.\n\nCWE-20: Improper Input Validation.\n\n## Patched version\n\nThe fix makes `getToken()` treat a malformed Bearer value as an invalid token and return `null`, matching how other undecodable tokens are already handled. Upgrade to the first release containing this fix (to be published; this advisory will be updated with the exact patched version before publication) and no code changes are required.\n\n## Workarounds\n\nIf you cannot upgrade immediately, either:\n\n- **Config/code-level:** wrap your `getToken()` calls so a thrown error is treated as \"no token\", e.g.\n\n  ```ts\n  let token = null\n  try {\n    token = await getToken({ req, secret })\n  } catch {\n    token = null\n  }\n  ```\n\n- Or strip/normalize the incoming `Authorization` header at the edge (proxy, middleware) before it reaches `getToken()`, rejecting values whose Bearer portion is not valid percent-encoding.\n\n## Credit\n\nReported by @deprrous. Thank you for the responsible disclosure.\n\n## Affected packages\n\n- `@auth/core >= 0.1.0, < 0.41.3`\n- `next-auth >= 5.0.0-beta.0, <= 5.0.0-beta.31`\n- `next-auth >= 4.0.6, <= 4.24.14`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@auth/core 0.41.3`\n- `next-auth 5.0.0-beta.32`\n- `next-auth 4.24.15`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}