CVE-2025-29927 PoC — Authorization Bypass in Next.js Middleware

Description

CVE-2025-29927 lab

Readme

# Next.js Authentication App

This is a Next.js application that implements authentication using NextAuth.js. The app features protected routes that require users to be authenticated to access certain pages.

## Project Structure

```
nextjs-auth-app
├── components
│   ├── Layout.js          # Layout component for consistent structure
│   ├── Navbar.js          # Navigation bar component
│   └── ProtectedRoute.js   # Component to protect routes
├── pages
│   ├── _app.js            # Custom App component
│   ├── _document.js       # Custom Document structure
│   ├── api
│   │   └── auth
│   │       └── [...nextauth].js # NextAuth.js configuration
│   ├── dashboard.js       # Protected Dashboard page
│   ├── index.js           # Landing page
│   ├── login.js           # Login page
│   └── profile.js         # User Profile page
├── public                 # Static assets
├── styles
│   ├── Home.module.css    # CSS module for Home component
│   └── globals.css        # Global CSS styles
├── utils
│   └── auth.js            # Utility functions for authentication
├── .env.local             # Environment variables
├── next.config.js         # Next.js configuration
├── package.json           # npm configuration
└── README.md              # Project documentation
```

## Getting Started

To get started with this project, follow these steps:

1. **Clone the repository:**
   ```
   git clone <repository-url>
   cd nextjs-auth-app
   ```

2. **Install dependencies:**
   ```
   npm install
   ```

3. **Set up environment variables:**
   Create a `.env.local` file in the root directory and add your environment variables, such as API keys and secrets.

4. **Run the development server:**
   ```
   npm run dev
   ```

5. **Open your browser:**
   Navigate to `http://localhost:3000` to view the application.

## Features

- **Authentication:** Users can log in and access protected routes.
- **Protected Routes:** The `ProtectedRoute` component ensures that only authenticated users can access certain pages like the Dashboard and Profile.
- **Responsive Design:** The application is designed to be responsive and user-friendly.

## Contributing

If you would like to contribute to this project, please fork the repository and submit a pull request with your changes.

## License

This project is licensed under the MIT License. See the LICENSE file for more details.

File Snapshot

Remarks