Skip to content
BuildThenTestedSee packages
CriticalLogin and permissions

Admin routes without any login check

A stranger who types /admin or /api/admin into the address bar can see or change everything the owner can. How the app knows who you are and what you are allowed to do. Check it yourself with the steps below; our test adds what a script and a second account can find.

What it looks like

// app/api/admin/export/route.ts
export async function GET() {
  const rows = await db.customers.findMany();
  return csv(rows);
}

// app/admin/page.tsx has no session check either
An export route and an admin page with no session check at all (a session is the server's record that someone signed in). Both are reachable by anyone who knows or guesses the address.

What happens

A stranger who types /admin or /api/admin into the address bar can see or change everything the owner can.

Where it shows up

Descriptive, not a verdict: builders and stacks whose defaults make this reachable, or that a public incident names. Each hub states the tool's own security features.

Seen in public

Apiiro's analysis of repositories at Fortune 50 companies found AI-assisted developers produced 3 to 4 times more commits and 10 times more security findings, with privilege escalation paths up 322%.

  • 3 to 4x Commits by AI-assisted developers vs peers
  • 10x Security findings by AI-assisted teams
  • more than 10,000 New AI-introduced findings per month by June 2025
  • +322% Privilege escalation paths
  • +153% Architectural design flaws

Sep 2025 · Apiiro · all sources

Check it yourself

Uses your builder's dashboard and your browser. No tools to install.

  1. Open a private browsing window so you are signed out.
  2. Type your app's address followed by /admin, /dashboard, /api/admin, /api/users and /api/export, one at a time.
  3. Also try any address you saw in the builder's file list under an admin folder.
  4. If your app uses Clerk or Supabase, open the builder's code view and check whether the admin route files call the auth helper at all.

A bad result is a page loading, or a raw data list appearing, without a sign-in prompt.

What we check

We crawl the built app and the source for every route and server action, then request each one signed out and as a non-admin account, including routes no link points to. The report lists each unprotected route with what it returned.

Fix direction

Add a session and role check inside every admin route handler and server action, not only in the page or middleware, and return HTTP 401 or HTTP 403 otherwise. Next.js's authentication guide shows the two-step check in a route handler; Clerk's auth.protect() does the same in one line.

Mechanism documented in: How to implement authentication in Next.js (verified 2026-09-21); auth() (verified 2026-09-21).

Covered by

Pre-launch check ($490, 48 hours) and Security sweep ($290, 24 hours)

Both include a re-check after your fixes.

Compare packages

Related patterns

  • Authorization enforced only in the browserLogin and permissions

    Anyone who calls the API directly, or edits the page in developer tools, gets the data and actions the screen was hiding.

    Critical
  • Default admin credentials left in placeLogin and permissions

    Anyone who reads the code or guesses a common placeholder can sign in as the administrator.

    Critical
  • Role chosen by the client at signupLogin and permissions

    A visitor who edits the signup request, or updates their own profile, can make themselves an admin.

    Critical
  • Debug mode left on in productionDeploy and config

    Anyone who causes an error sees file paths, query text and sometimes environment values, and dev-only shortcuts such as skipped checks or seeded test users stay active for real visitors.

    Medium

Questions

how do i check if my admin page is protected

Open a private window and type the admin address directly, then try the API addresses behind it such as /api/admin and /api/export. A sign-in prompt or an error is the expected result; a page or a data list is not. Repeat the test signed in as a normal, non-admin account.

does nextjs middleware protect api routes

Only for the paths its matcher covers, and Next.js's own guide calls middleware an optimistic check that should not be the only line of defence. Clerk's docs likewise recommend protecting access in the code that reads or mutates the data rather than in middleware. Each admin route handler and server action needs its own check.

what happens if my admin api has no auth

Anyone who finds the address gets administrator access to data and actions, and addresses are easy to find in the page's JavaScript. Apiiro's 2025 analysis of AI-assisted repositories reported a sharp rise in privilege escalation paths, which is the category this falls into; Apiiro sells security tooling. The private-window test in the self-check takes a few minutes.

Back to the catalogue, or run the self-check for your stack.