The issue arises because Next.js expects catch-all segments to be placed in their own folder and to be the last part of the URL. To resolve this, try restructuring your folder like this:

app/api/auth/[...nextauth]/route.js

this should fix the issue.