CVE-2025-29927 PoC — Authorization Bypass in Next.js Middleware

Source

Associated Vulnerability

Description

CVE-2025-29927 lab

Readme

# Next.js Authentication App

This is a Next.js application that implements authentication using NextAuth.js. The app features protected routes that require users to be authenticated to access certain pages.

## Project Structure

```
nextjs-auth-app
├── components
│   ├── Layout.js          # Layout component for consistent structure
│   ├── Navbar.js          # Navigation bar component
│   └── ProtectedRoute.js   # Component to protect routes
├── pages
│   ├── _app.js            # Custom App component
│   ├── _document.js       # Custom Document structure
│   ├── api
│   │   └── auth
│   │       └── [...nextauth].js # NextAuth.js configuration
│   ├── dashboard.js       # Protected Dashboard page
│   ├── index.js           # Landing page
│   ├── login.js           # Login page
│   └── profile.js         # User Profile page
├── public                 # Static assets
├── styles
│   ├── Home.module.css    # CSS module for Home component
│   └── globals.css        # Global CSS styles
├── utils
│   └── auth.js            # Utility functions for authentication
├── .env.local             # Environment variables
├── next.config.js         # Next.js configuration
├── package.json           # npm configuration
└── README.md              # Project documentation
```

## Getting Started

To get started with this project, follow these steps:

1. **Clone the repository:**
   ```
   git clone <repository-url>
   cd nextjs-auth-app
   ```

2. **Install dependencies:**
   ```
   npm install
   ```

3. **Set up environment variables:**
   Create a `.env.local` file in the root directory and add your environment variables, such as API keys and secrets.

4. **Run the development server:**
   ```
   npm run dev
   ```

5. **Open your browser:**
   Navigate to `http://localhost:3000` to view the application.

## Features

- **Authentication:** Users can log in and access protected routes.
- **Protected Routes:** The `ProtectedRoute` component ensures that only authenticated users can access certain pages like the Dashboard and Profile.
- **Responsive Design:** The application is designed to be responsive and user-friendly.

## Contributing

If you would like to contribute to this project, please fork the repository and submit a pull request with your changes.

## License

This project is licensed under the MIT License. See the LICENSE file for more details.

File Snapshot

 [4.0K]  /data/pocs/1946056f3e1d29263d52d1a453255de8129f2b84
├── [4.0K]  components
│   ├── [ 228]  Layout.js
│   ├── [ 970]  Navbar.js
│   └── [ 642]  ProtectedRoute.js
├── [1.3K]  middleware.js
├── [ 154]  next.config.js
├── [ 515]  package.json
├── [4.0K]  pages
│   ├── [4.0K]  api
│   │   └── [4.0K]  auth
│   │       └── [1.4K]  [...nextauth].js
│   ├── [ 351]  _app.js
│   ├── [1.1K]  dashboard.js
│   ├── [ 497]  _document.js
│   ├── [ 261]  index.js
│   ├── [1.3K]  login.js
│   └── [ 561]  profile.js
├── [2.5K]  README.md
├── [4.0K]  styles
│   ├── [ 473]  Dashboard.module.css
│   ├── [ 504]  globals.css
│   └── [ 506]  Home.module.css
├── [4.0K]  utils
│   └── [ 170]  auth.js
└── [110K]  yarn.lock

6 directories, 19 files

Remarks