Detections
Analytics

SCA: security update for @auth/core, next-auth (GHSA-xmf8-cvqr-rfgj)

high Tenable Self-Hosted Container Security Plugin ID 445216

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and
 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an
 uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is
 present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding
 causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is
 commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated
 request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request
 denial of service without exposing tokens, sessions, or other data and without bypassing authentication.
 This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32. (CVE-2026-73418)

Solution

Update the @auth/core library and its related packages to version 0.41.3 or later.

See Also

https://github.com/advisories/GHSA-xmf8-cvqr-rfgj

Plugin Details

Severity: High

ID: 445216

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 7/23/2026

Updated: 8/13/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-73418

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/23/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-73418

cwe: CWE-20