Read the docs
TI-2018-05300 Aliases CVE-2018-7307GHSA-wpq7-q8j4-72jg

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the…

Priority LOW 39CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.

Why it matters now

EPSS 0.00512 43rd percentileScored 2026-11-07
Fix Fixed auth0-js (npm): 9.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—auth0-js (npm)before 9.3.09.3.0Patch availableGHSA-wpq7-q8j4-72jg
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • auth0-js (npm) Vendor— Affected before 9.3.0 Fixed in 9.3.0 Patch available GHSA-wpq7-q8j4-72jg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:auth0:auth0.js:*:*:*:*:*:*:*:*before 9.3Vulnerableauth0
  • cpe:2.3:a:auth0:auth0.js:*:*:*:*:*:*:*:* Versions before 9.3 Vulnerable ·auth0

Remediation

  • Fix · GHSA-wpq7-q8j4-72jg auth0-js (npm) Fixed in 9.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-7307
  2. 2026-10-03 Alias added: GHSA-wpq7-q8j4-72jg

References

Advisory 3

  • TI-2018-05020 The Auth0 authentication service before 2017-10-15 allows privilege escalation because… CVSS 3.0CRITICAL 9.8
  • TI-2018-05021 CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. CVSS 3.0HIGH 8.8
  • TI-2020-11898 Authorization header is not sanitized in an error object in auth0 CVSS 3.1HIGH 7.7
  • TI-2017-12531 A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting… CVSS 3.0HIGH 7.5
  • TI-2026-30591 Improper Permission Checking in Auth.js SDK CVSS 3.1HIGH 7.1
  • TI-2020-04319 Information disclosure through error object CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences