Detect Nextjs Middleware Authorization Bypass

Next.js middleware authorization-bypass pattern — successful requests to authenticated routes without going through the expected auth path.

KQL Library  /  Analytics Rules

 Analytics Rules detect-nextjs-middleware-authorization-bypass.kql

Next.js middleware authorization-bypass pattern — successful requests to authenticated routes without going through the expected auth path.

 Download .kql 
// Author: Ian D. Hanley (DevSecOpsDad) | linkedin.com/in/ianhanley | devsecopsdad.com | devsecopsdadattack.com
// Detects the Next.js middleware authorization-bypass pattern by counting who successfully reached
// authenticated routes without going through the expected auth path. Catches the exploitation of
// the specific middleware weakness by shape rather than by known payload.
// Source: KQL Detection of the Week: A Name Is a Claim, Not a Fact (2026-06-29) — https://devsecopsdadattack.com/2026-06-29-KQL-Detection-of-the-Week_-A-Name-Is-a-Claim_-Not-a-Fact/

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any ("/_next/", "/api/", "/middleware")
| where RequestMethod in ("GET", "POST", "HEAD")
| summarize
    TotalRequests = count(),
    Codes200 = countif(ResponseCode == 200),
    Codes401 = countif(ResponseCode == 401),
    Codes403 = countif(ResponseCode == 403),
    UserAgents = make_set(UserAgent),
    Paths = make_set(RequestURL)
    by SourceIP, DeviceVendor, DeviceProduct, DestinationPort, bin(TimeGenerated, 5m)
| where TotalRequests > 10 and Codes401 > 0 and Codes200 > 0
| extend BypassRatio = todouble(Codes200) / todouble(TotalRequests)
| where BypassRatio > 0.3
| order by TotalRequests desc