AIKIDO-2026-10761
next is vulnerable to Authentication Bypass
75
High Risk
This Affects:
nextTL;DR
App Router transport-specific segment-prefetch route variants can bypass middleware or proxy authorization checks. Crafted request paths can reach protected content without hitting expected matcher logic. This creates an alternate access path that weakens route-level protection assumptions. The fix includes transport variants in matcher generation so authorization checks apply consistently.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
next is vulnerable to Authentication Bypass in versions 15.2.0 - 15.5.15 and 16.0.0 - 16.2.4.
How to fix this
Upgrade the next library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant