CVE-2025-29927 - Next.js Auth Bypass PoC

This is a Proof of Concept (PoC) in Python to detect the critical vulnerability CVE-2025-29927 that affects applications developed with Next.js, specifically when they use middleware for authorization.

📌 The vulnerability allows completely bypassing authentication, accessing protected routes if the middleware is poorly implemented.

---

🧠 Description

CVE-2025-29927 allows attackers to bypass Next.js authentication middleware when certain routes or configurations are compromised. This is due to unexpected behavior in the Edge runtime combined with middleware-protected routes.

This PoC checks whether the server uses Next.js with middleware and could be susceptible to this flaw, based on the returned HTTP headers.

---

🚀 Usage

Requirements

• Python 3.x
• requests module
  Install it with:
  root@kitploit:~

  pip install requests