Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication.
If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.
16.2.11Exploitability
AV:NAC:LAT:PPR:NUI:NVulnerable System
VC:HVI:LVA:NSubsequent System
SC:NSI:NSA:N8.3/CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N