[rohan_]

Most don't understand this issue:

Auth middleware is used for _routing_ (e.g. if you're not signed-in, you'll be redirected to the sign-in page).

This just means a 500 is thrown due to the auth() call returning null on the server.

[simonw]

That depends entirely on how you implemented your middleware.

This vulnerability also isn't explicitly about auth: it's about attackers being able to send a colon separated list of middleware to skip. That could affect applications in all kinds of unexpected ways depending on what they are using middleware for and how they designed their application.