auth0

Records58All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical11CVSS 9.0–10.0

CVSS high24CVSS 7.0–8.9

Exploited now

auth0 records in CISA KEV

No auth0 vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Auth0.js 7 records MEDIUM Nextjs-auth0 5 records LOW Jsonwebtoken 4 records MEDIUM Lock 4 records LOW Login By Auth0 4 records MEDIUM Wp-auth0 3 records MEDIUM Auth0-php 2 records MEDIUM Express Openid Connect 2 records MEDIUM

Records

7 records in Auth0.js · all components

TI-2018-05020 CVE-2018-6873 · GHSA-mc68-wpcg-f86r

The Auth0 authentication service before 2017-10-15 allows privilege escalation because…

MEDIUM 46

The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02228 Published 2018-04-04 No fix listed CWE-287

TI-2018-05300 CVE-2018-7307 · GHSA-wpq7-q8j4-72jg

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the…

LOW 39

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00512 Published 2018-03-06 Fixed in 9.3.0 CWE-352

TI-2018-05021 CVE-2018-6874 · GHSA-wv26-rj8c-4r33

CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.

LOW 39

CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00736 Published 2018-04-04 Fixed in 9.0.0 CWE-352

TI-2020-11898 CVE-2020-15125 · GHSA-5jpf-pj32-xx53

Authorization header is not sanitized in an error object in auth0

LOW 37

In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01539 Published 2020-07-29 Fixed in 2.27.1 CWE-209

TI-2017-12531 CVE-2017-17068 · GHSA-3rpr-mg43-xhq4

A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting…

LOW 36

A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0142 Published 2017-12-06 Fixed in 8.12.0 CWE-200

TI-2026-30591 CVE-2026-42280 · GHSA-8qjv-jj2q-x832

Improper Permission Checking in Auth.js SDK

LOW 31

Auth0.js is a client-side JavaScript library for Auth0.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00211 Published 2026-05-27 Fixed in 10.0.0 CWE-863

TI-2020-04319 CVE-2020-5263 · GHSA-prfq-f66g-43mp

Information disclosure through error object

LOW 26

auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability.

CVSS 3.1MEDIUM 5.5 Local High privileges User interaction EPSS 0.00871 Published 2020-04-09 Fixed in 9.12.3, 9.13.2 CWE-522

Open these records in search →