Next.js Middleware Authentication Bypass Through Client-Controlled Internal Header

In recent CTF challenge, authentication bypass was identified in a Next.js application. The issue arises from improper trust in a…