Intro
Today while messing around with one of the HackTheBox retired machines “Previous”, the method of gaining initial access is due to the “Middleware” Authentication Bypass in Next.js. This vulnerability can be exploited to bypass authorization and access sensitive pages. Details of the affected versions can be found here CVE-2025-29927.
Background
The CVE is a vulnerability in the handling of “middleware”. In its simplest terms (the only ones I understand) middleware is a function used to process a user request in some form or fashion. This could be as simple as parsing raw data into a JSON template, or as much as providing authentication to an application that doesn’t have any. In the case of the HackTheBox machine, this was the case. The application uses Next Auth as its authentication provider. In an incredibly oversimplified piece of pseudocode, authentication in this application looks like this (forgive me im not a javascipt developer).