PT-2026-71311

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session...

Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

Summary The exported getToken helper next-auth/jwt and @auth/core/jwt can throw an uncaught exception when it reads a malformed Authorization: Bearer … header. When no session cookie is present, getToken URL-decodes the bearer value before validating it, and malformed percent-encoding causes the...

PT-2026-44196

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw in the ClientRegistrationAuth component allows a remote unauthenticated attacker to cause a Denial of Service DoS. By sending a specially crafted POST request with a malformed...