Link to the code that reproduces this issue

https://github.com/nextauthjs/next-auth-example.git

To Reproduce

1. Edit the auth.ts file from the next-auth example, to add some trace in the authorized callback; e.g.
   console.error("HERE: ", request.nextUrl.username, request.nextUrl.password)
2. Normal (npm) package install, set secret, etc.
3. npm run dev
4. Perform a query with a username (and optional password); e.g. curl -s -o /dev/null http://user:pw@localhost:3000/
5. Note the console trace.

Current vs. Expected behavior

This may be a nextauth issue as opposed to next.js direct, but as it's in the basic URL object it has been reported here.
Whilst providing a username (and password) via the URL is generally a legacy thing, the URL extraction should still be honouring it; especially as it has the fields.

Provide environment information

Operating System:
  Platform: linux
  Arch: x64
  Version: #1 SMP PREEMPT_DYNAMIC Wed May 1 19:11:28 UTC 2024
  Available memory (MB): 31810
  Available CPU cores: 4
Binaries:
  Node: 22.14.0
  npm: 10.9.2
  Yarn: N/A
  pnpm: N/A
Relevant Packages:
  next: 15.3.1
  eslint-config-next: N/A
  react: 18.3.1
  react-dom: 18.3.1
  typescript: 5.8.3
Next.js Config:
  output: standalone

Which area(s) are affected? (Select all that apply)

Connection, Middleware

Which stage(s) are affected? (Select all that apply)

next dev (local), next start (local), Other (Deployed)

Additional context

The bespoke app in which this was discovered is using:
"next": "^15.3.1",
"next-auth": "^5.0.0-beta.25",