Bypassing Security on Next.js Websites with Zero Credentials Feared

Exploiting CVE-2025-29927 to bypass Next.js middleware-based authentication using the x-middleware-subrequest internal header, accessing a protected internal status page without credentials. Next.js uses an internal header to prevent middleware from running twice on subrequests. In versions before 1