There is auth bypass on Next.js with public exp. https://github.com/advisories/GHSA-f82v-jwr5-mffw Please update to >=15.2.3