Lab 248 — PulseBoard — Next.js Middleware Authorization Bypass

hackadvisor

Task: Next.js team analytics dashboard (PulseBoard) with middleware-based role authorization protecting admin panel; NextAuth for authentication. Solution: bypass middleware via CVE-2025-29927 x-middleware-subrequest header (repeated 5x) with valid session cookie to access /admin/secrets and retrieve PLATFORM_MASTER_KEY.