Authentication bypass using an alternate path or channel in Next.js - CVE-2026-44574
Published: May 6, 2026
Vulnerability identifier: #VU130277
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44574
CWE-ID: CWE-288
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass authorization checks and access protected content.
The vulnerability exists due to authentication bypass using an alternate path or channel in middleware protection for dynamic routes when handling specially crafted query parameters. A remote user can send specially crafted query parameters to bypass authorization checks and access protected content.
The issue affects applications that rely on middleware path matching to protect dynamic routes.
Affected software
Next.js
How to mitigate CVE-2026-44574
Install security update from vendor's website.
Next.js - addressed in versions 15.5.16, 16.2.5