Improper authorization in Next.js - CVE-2025-29927
Published: March 21, 2025 / Updated: June 23, 2026
Vulnerability identifier: #VU105939
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-29927
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization process.
The vulnerability exists due to missing authorization checks. A remote attacker can bypass authorization mechanism and compromise the affected application.
Affected software
Next.js
Event Processing
IBM Security QRadar Network Threat Analytics
QRadar Pre-Validation App
Maximo Application Suite - Edge Data Collector
MANTA Automated Data Lineage for IBM Cloud Pak for Data
IBM Cloud Pak for Security
QRadar Suite
IBM Security QRadar Analyst Workflow
Event Processing
IBM Security QRadar Network Threat Analytics
QRadar Pre-Validation App
Maximo Application Suite - Edge Data Collector
MANTA Automated Data Lineage for IBM Cloud Pak for Data
IBM Cloud Pak for Security
QRadar Suite
IBM Security QRadar Analyst Workflow
How to mitigate CVE-2025-29927
Install updates from vendor's website.
Next.js - addressed in versions 13.5.9, 14.2.25, 15.2.3
Event Processing - update to 1.4.0
IBM Security QRadar Network Threat Analytics - update to 1.4.2
IBM Cloud Pak for Security - update to 1.11.9.0
QRadar Pre-Validation App - update to 2.0.2
Maximo Application Suite - Edge Data Collector - update to 9.0.10
QRadar Suite - update to 1.11.9.0
IBM Security QRadar Analyst Workflow - update to 3.0.1
MANTA Automated Data Lineage for IBM Cloud Pak for Data - update to 5.1.3
Event Processing - update to 1.4.0
IBM Security QRadar Network Threat Analytics - update to 1.4.2
IBM Cloud Pak for Security - update to 1.11.9.0
QRadar Pre-Validation App - update to 2.0.2
Maximo Application Suite - Edge Data Collector - update to 9.0.10
QRadar Suite - update to 1.11.9.0
IBM Security QRadar Analyst Workflow - update to 3.0.1
MANTA Automated Data Lineage for IBM Cloud Pak for Data - update to 5.1.3
Links to Public Exploits and PoC-codes
- Exploit #12780 - Next.js Middleware Authorization Bypass Scanner (June 23, 2026)
- Exploit #12231 - CVEs (A repository containing exploits for various CVEs (created by me or others)) (January 4, 2026)
- Exploit #12088 - CVE-2025-29927 (November 7, 2025)
- Exploit #11896 - CVE-2025-29927 (August 29, 2025)
- Exploit #11813 - Thank-u-Next (CVE-2025-29927 PoC | Auth Bypass Exploit | Python Tool using httpx | Middleware Vulnerability | Ethical Hacking Toolkit) (August 1, 2025)
- Exploit #11695 - poc-cve-2025-29927 (June 20, 2025)
- Exploit #11349 - CVE-2025-29927 (May 2, 2025)
- Exploit #11300 - CVE-2025-29927 (April 11, 2025)
- Exploit #11256 - NextSploit (March 31, 2025)
- Exploit #11249 - CVE-2025-29927 (March 25, 2025)
- Exploit #11248 - CVE-2025-29927-PoC-Exploit (March 25, 2025)
- Exploit #11245 - nextjs-middleware-bypass-demo (March 25, 2025)
- Exploit #11244 - CVE-2025-29927 (March 25, 2025)
- Exploit #11243 - CVE-2025-29927 (March 25, 2025)
External References
Related Security Bulletins
- Authorization bypass in Next.js
- IBM MANTA Automated Data Lineage for IBM Cloud Pak for Data update for Next.js
- IBM Edge Data Collector update for Next.js
- IBM Event Processing update for Next.js
- Multiple vulnerabilities in IBM Security QRadar Analyst Workflow for IBM QRadar SIEM
- Multiple vulnerabilities in IBM Security QRadar Network Threat Analytics
- Multiple vulnerabilities in IBM QRadar Pre-Validation App
- Multiple vulnerabilities in IBM QRadar Suite