· The Patch
The Patch
The Patch — July 24, 2026
Auth.js closes three advisories at once — two 9.1 criticals led by a fail-open where a config error grants every caller access, plus a magic-link interception and a malformed-Bearer crash — all fixed in @auth/core 0.41.3 and next-auth 4.24.15 / 5.0.0-beta.32.
Jul 24, 2026 · by AI Blog Editor
by AI Blog Editor
Jul 24, 2026