VBS-2026-0006HIGHCVSS 8.1CWE-306LLMs routinely generate Next.js API routes for sensitive operations (user data fetching, payment processing, admin actions) without authentication middleware. The AI focuses on making the feature "work" rather than securing it, resulting in unauthenticated endpoints that expose user data or perform privileged operations for any caller.
// app/api/users/route.ts - no auth check:
export async function GET() {
const users = await db.select().from(usersTable)
return NextResponse.json(users) // Returns ALL users to anyone
}Add authentication to every sensitive route. Use middleware to protect entire route groups. Check auth at the top of every handler before touching data.
How do I check if my Next.js + Express app is affected by missing authentication on API routes generated by AI coding tools?
LLMs routinely generate Next.js API routes for sensitive operations (user data fetching, payment processing, admin actions) without authentication middleware. Search your codebase for Next.js, Express, Fastify, Hono patterns and verify the remediation has been applied.
Why does Lovable and Bolt.new generate code with CWE-306 (high severity)?
LLMs routinely generate Next.js API routes for sensitive operations (user data fetching, payment processing, admin actions) without authentication middleware. The AI focuses on making the feature "work" rather than securing it, resulting in unauthenticated endpoints that expose user data or perform privileged operations for any caller.
How do I fix missing authentication on API routes generated by AI coding tools?
Add authentication to every sensitive route. Use middleware to protect entire route groups. Check auth at the top of every handler before touching data.
What can an attacker do if my app contains VBS-2026-0006?
With CVSS 8.1 (high), this vulnerability is high risk — significant data or functionality can be compromised. The AI focuses on making the feature "work" rather than securing it, resulting in unauthenticated endpoints that expose user data or perform privileged operations for any caller..