CVE-2025-29927 PoC — Authorization Bypass in Next.js Middleware

Source

https://github.com/websecnl/CVE-2025-29927-PoC-Exploit

Associated Vulnerability

Title:Authorization Bypass in Next.js Middleware (CVE-2025-29927)
Description:Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.

Description

Proof-of-Concept for Authorization Bypass in Next.js Middleware

Readme

# CVE-2025-29927-PoC-Exploit
Proof-of-Concept for Authorization Bypass in Next.js Middleware

You can run this against a vulnerable version here: https://github.com/lirantal/vulnerable-nextjs-14-CVE-2025-29927

# Running

Execution is straightforward.

1. Python3 CVE-2025-29927-PoC-Exploit.py

It will prompt you to type the domain name. (You have two options: First, type only a domain name. Second, domain name with path)

If you type it like this "domain.com" it will try to brute force the authenticated paths and try those once it finds one with status code 200.

Alternatively you can provdie the authenticated page by yourself for example "domain.com/admin/clients"

In this case it will show only the result for this endpoint.

Results are displayed as JSON.


![image](https://github.com/user-attachments/assets/2e55acb4-2732-41fe-8037-63c92ba5a015)

File Snapshot


 [4.0K]  /data/pocs/79cf92e5f817762409f3874a6f768d347bc26e73
├── [9.4K]  CVE-2025-29927-check.py
└── [ 860]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!