# Minting Next.js Authentication Cookies

With NEXTAUTH_SECRET leaked via React2Shell RCE, attacker mints valid Auth.js session cookies to impersonate any user persistently.

- Payout: Research
- Severity: high
- Program: NextAuth
- Write-up by: Johann Rehberger
- Disclosed: 2026-01-15
- Write-up quality: 6/10
- Original: https://embracethered.com/blog/posts/2026/minting-next-auth-nextjs-auth-cookies-react2shell-threat/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-minting-next-auth-nextjs-auth-cookies-react2shell-threat
- Tags: area:web domain:web impact:ato impact:privesc kind:research platform:research sev:high tech:jwt tech:nextjs technique:source-review vuln:auth-bypass vuln:secrets-leak

**Target:** Next.js Auth.js/next-auth session cookie (JWE)
**Root cause:** Session cookies are JWE-encrypted with keys HKDF-derived from a single static NEXTAUTH_SECRET/AUTH_SECRET, salted only by the public cookie name; anyone with the secret can mint arbitrary sessions.
**Steps:**
1. Obtain NEXTAUTH_SECRET (e.g. via React2Shell RCE running `env`)
2. Derive encryption key via HKDF using salt = cookie name (e.g. `authjs.session-token`, `__Secure-authjs.session-token`, `next-auth.session-token`)
3. Encode JWT with `encode` (JWE) containing arbitrary claims (name, email, sub, role)
4. Set cookie `next-auth.session-token=<token>; HttpOnly; SameSite=lax; Path=/; Max-Age=2592000`
5. If chunked cookies (token0+token1), concatenate values in order before decoding
**How found:** Reading next-auth source: noted the HKDF salt is just the cookie name (public) and the only secret input is NEXTAUTH_SECRET, so a cookie minter/decoder is trivial to build.
**Exploitation:** After RCE leaks env vars, attacker uses the secret to mint a session cookie for any user/role and sets it in their browser, gaining persistent authenticated access even after OAuth client_secret rotation.
**Escalation:** Rotating OAuth secrets alone is insufficient; the static NEXTAUTH_SECRET remains a lasting backdoor enabling impersonation of any user with any role.
**Insight:** When a framework derives session-signing keys from a single env secret with a public salt, that secret is a standalone auth bypass — check whether rotating OAuth/API creds leaves session forgery possible.

## Proof of concept (copied exactly from the original report)

**Cookie creator command with custom cookie name**

```
node cookie-creator.js --cookie-name 'authjs.session-token'
```

**Cookie decoder command on session token**

```
node cookie-decoder.js 'eyJhbGci...'
```

**Minted Set-Cookie header output**

```
next-auth.session-token=eyJhbGci...; HttpOnly; SameSite=lax; Path=/; Max-Age=2592000
```