#Authorization Bypass

1 post

BugForge - Weekly - Vaultly

A Next.js middleware authorization bypass (CVE-2025-29927): forging the internal x-middleware-subrequest header skips the auth check on /admin and leaks a recovery key.

Broken Access Control Authorization Bypass Next.js CVE

Posted on 2026-07-18 09:00 6 min read