Auth.js Configuration Error Leads to Silent Fail-Open in Existence-Based Auth Checks
A critical vulnerability in Auth.js (next-auth) version 5 allows misconfigured applications to fail open, granting unauthorized access to all users when the auth layer encounters a server-side error. This issue arises from existence-based auth checks evaluating to true for every request, including unauthenticated ones, when the auth object is populated with an error. The vulnerability has a CVSS score of 9.1 and is classified under CWE-636 (Not Failing Securely) and CWE-285 (Improper Authorization).