NextSploit

🔍 NextSploit: Next.js CVE-2025-29927 Scanner & Exploiter ⚠️ NextSploit is a command-line tool designed to detect and exploit CVE-2025-29927 , a security flaw in Next.js. The tool first identifies if a target website is running Next.js and determines whether its version falls within the vulnerable...

CVE-2025-29927

CVE-2025-29927 in Next.js 15.2.0 How to Run: git clone https://github.com/nyctophile0969/CVE-2025-29927 cd CVE-2025-29927 npm install [email protected] npm run dev...

test-cve-2025-29927

Test app to exploit CVE-2025-29927 The NextJS app has cookie based authentification and a middleware to prevent unauthorized access to /admin page. To start the app run yarn then yarn dev To get unauthorized access to /admin page by using CVE-2025-29927 vulnerability run a proxy-server which adds...

CVE-2025-29927-PoC

CVE-2025-29927 — Next.js Middleware Authorization Bypass Verification PoC A small GitHub project for verifying CVE-2025-29927 Next.js Middleware Authorization Bypass in a local authorization lab VMware: Ubuntu target VM + Kali attacker VM. ⚠️ Disclaimer : This project is intended solely for...

CVE-2025-29927-Proof-of-Concept

Walkthrough Step 1 5 min Hint Which network services are exposed by the target? — — — Solution kali@kali:$ nmap kali@kali:$ nmap -sC -sV -p Step 2 5 min Hint 1 The landing page only reveals a login page, but web servers often expose additional paths. Hint 2 Try using a directory brute-forcing too...

nextjs-cve-2025-29927-poc

Next.js POC for CVE-2025-29927 Authorization Bypass in Next.js Middleware · CVE-2025-29927 · GitHub Advisory Database Next.js and the corrupt middleware: the authorizing artifact - zherowebsecurity- What is this? This vulnerability allow to bypass middleware logics. src/middleware.ts: // always...

alpr-dashboard-patches

ALPR Dashboard runtime patches Two drop-in patches for the algertc/alpr-dashboard Docker project. Both are deployable without modifying or rebuilding the upstream image. What's here logger-fix/ — async logger + cleanup throttle Replaces the built-in sync log transport full-file read + rewrite on...

exploit-CVE-2025-29927

Exploit for CVE-2025-29927 Next.js - Authorization Bypass Like this repo? Give us a ⭐! For educational and authorized security research purposes only. Exploit Author @UNICORDev by @NicPWNs and @Dev-Yeoj Vulnerability Description Next.js is a React framework for building full-stack web application...

CVE-2025-29927

This repository does not have a README...

poc-cve-2025-29927

Next.js Middleware Bypass CVE-2025-29927 Proof of Concept This repository contains a proof of concept POC for CVE-2025-29927 , a critical vulnerability in Next.js that allows attackers to bypass authorization checks implemented in middleware. 📋 Table of Contents 1. Running the POC Application 2...

vulnbox-easy-CVE-2025-29927

Man-in-the-middle This application is named Man-in-the middle because it contains a vulnerability in Next.JS middleware and the flag is in the API call. 🚀 Production Setup 1. .env.production DATABASEURL=postgresql://postgres:password@db:5432/nextauth JWTSECRET=your-production-secret 2. Build and...

CVE-2025-29927-Nextjs-Analysis

CVE-2025-29927 Next.js Analysis This repository contains a self-hosted Next.js lab environment created for analyzing CVE-2025-29927 in Docker. Overview CVE-2025-29927 is a vulnerability related to authorization checks implemented in Next.js middleware. This project was built as a local lab to...

Vulnerable-Lab-NextJS-CVE-2025-29927

Next.js Docker Hello World A simple Hello World application using Next.js 12.2 and Docker. Prerequisites Docker Building and Running the Application 1. Build the Docker image: docker build -t nextjs-docker-hello . 2. Run the container: docker run -p 3000:3000 nextjs-docker-hello 3. Open your...

cve-2025-29927-lab

This repository contains a deliberately vulnerable web application built using Next.js. It is designed to demonstrate and study the security issue known as CVE-2025-29927. The goal of this project is to help security researchers, students, and bug bounty hunters understand how the vulnerability...

nextjs-auth-bypass

nextjs-auth-bypass Analysis and exploitation of a Next.js authorization bypass vulnerability CVE-2025-29927 Next.js Authorization Bypass – CVE Analysis Overview This project demonstrates an authorization bypass vulnerability in a Next.js application caused by improper middleware validation...

CVE-2025-29927_Next.js_Auth_Bypass

CVE-2025-29927 - Next.js Auth Bypass PoC This is a Proof of Concept PoC in Python to detect the critical vulnerability CVE-2025-29927 that affects applications developed with Next.js , specifically when they use middleware for authorization. 📌 The vulnerability allows completely bypassing...

CVE-2025-29927-NextJS

📦 Next.js CVE-2025-29927 - Proof of Concept This repository contains a minimal Proof of Concept PoC for exploiting CVE-2025-29927, a high-severity vulnerability affecting specific versions of Next.js that allows unauthorized access to internal application files through crafted URLs. ⚠️ Disclaimer...

cve-2025-29927-lab

CVE-2025-29927 Lab Minimal reproduction lab for CVE-2025-29927 — Next.js middleware authorization bypass CVSS 9.1. Companion to: N-Day Analysis writeup on Medium What this is A Next.js 15.2.2 app vulnerable with a cookie-gated /dashboard route. The middleware auth check can be bypassed by sending...

middleforce

MiddleForce 🔍 Overview MiddleForce is a specialized security testing tool designed to detect and exploit the CVE-2025-29927 vulnerability in Next.js middleware. This tool helps security professionals identify applications vulnerable to middleware bypass attacks. 🚀 Features Middleware Bypass...

cve-2025-29927-nextjs

Himalaya Tech Admin Panel — CVE-2025-29927 Demo WARNING: This application is intentionally vulnerable. For educational and authorized security research purposes only. Do NOT deploy to a public server. About This Demo This app demonstrates CVE-2025-29927 , a critical authentication bypass...