Auth and sessions
Server action without its own auth check
The page checks the session, but the exported action it calls does not, and actions can be invoked by direct POST.
TermsAPI (the interface other software calls; tested directly, without the UI in between) · cross-site request forgery (another site making a user's browser send a state-changing request with the user's cookies) · cross-site scripting (user-typed text rendered as markup, so a script in a name or comment runs in other users' browsers) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Next.js documents that an exported server action is reachable via POST even when unused in the UI and that page-level checks do not extend to it.
An exported Server Action is reachable by direct POST request even when not used in the UI; a page-level authentication check does not extend to the Server Actions defined within it; environment variables prefixed NEXT_PUBLIC_ are exposed to the client.
Source: Next.js docs, 2026-08-25 · verified 2026-09-21
How we detect it
POST to each action id without a session and with a foreign session.
Checklist items that catch it
Server actions and API mutations re-check authentication and authorization
automated Invoke each server action or mutation endpoint directly by POST, without a session and with another user's session.
Every mutation rejects the unauthenticated call and the foreign-user call.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.