Next.js Middleware Authentication Bypass Through Client-Controlled Internal Header

In recent CTF challenge, authentication bypass was identified in a Next.js application. The issue arises from improper trust in a client-controlled internal header used by the framework’s middleware layer.

By manipulating the x-middleware-subrequest header, it was possible to bypass authentication checks and directly access restricted endpoints such as /dashboard.

The target application is built using Next.js 14.x, which relies heavily on middleware for request filtering and authentication enforcement.

/dashboard → Requires authentication

Unauthenticated users are normally redirected to the login page.

In initial recon phase found the hidden path and sensitive information like internal header used for subrequest routing.

robots.txt

when accessing the /dashboard endpoint without authentication it is temporary redirect to /login page. At this stage, standard access control appeared properly implemented.

during recon we found the x-middleware-subrequest header is used for subrequest routing purpose.

By adding the x-middleware-subrequestheader, the middleware authentication layer was completely bypassed, and the protected dashboard page was returned successfully.

dashboard

Root Cause Analysis: the application treated an internal Next.js control header as a trusted security signal.

Thanks for reading!

follow me for more cybersecurity content : Medium Blog

Subscribe My youtube channel : https://www.youtube.com/@cybervolt07

Your support helps me keep sharing more content. See you in the next one!