Read the docs

auth0

Records58All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical11CVSS 9.0–10.0
CVSS high24CVSS 7.0–8.9

Exploited now

auth0 records in CISA KEV

No auth0 vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Auth0.js 7 records MEDIUM Nextjs-auth0 5 records LOW Jsonwebtoken 4 records MEDIUM Lock 4 records LOW Login By Auth0 4 records MEDIUM Wp-auth0 3 records MEDIUM Auth0-php 2 records MEDIUM Express Openid Connect 2 records MEDIUM

Records

4 records in Jsonwebtoken · all components

TI-2015-07615 CVE-2015-9235 · GHSA-c7hr-j4mj-j2w6

Improper input validation in HackerOne jsonwebtoken node module

Priority MEDIUM 53

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digit…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.08367 Published 2018-05-29 Fixed in 4.2.2 CWE-20
TI-2022-07594 CVE-2022-23539 · GHSA-8cf7-32gw-wr33

jsonwebtoken unrestricted key type could lead to legacy keys usage

Priority LOW 36

Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00524 Published 2022-12-22 Partial fix · 9.0.0 CWE-327
TI-2022-07595 CVE-2022-23540 · GHSA-qwph-4952-7xr6

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

Priority LOW 34

In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00572 Published 2022-12-22 Partial fix · 9.0.0 CWE-287
Open these records in search →