Read the docs
TI-2026-30591 Aliases CVE-2026-42280GHSA-8qjv-jj2q-x832

Improper Permission Checking in Auth.js SDK

Priority LOW 31CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00211 11th percentileScored 2026-11-07
Fix Fixed auth0-js (npm): 10.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
auth0auth0.js8.11.0 – 9.32.0—No fix listedCNA
—auth0-js (npm)8.11.0 to before 10.0.010.0.0Patch availableGHSA-8qjv-jj2q-x832
  • auth0.js Vendorauth0 Affected 8.11.0 – 9.32.0 Fixed in — No fix listed CNA
  • auth0-js (npm) Vendor— Affected 8.11.0 to before 10.0.0 Fixed in 10.0.0 Patch available GHSA-8qjv-jj2q-x832

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:auth0:auth0.js:*:*:*:*:*:node.js:*:*8.11.0 to before 10.0.0Vulnerableauth0
  • cpe:2.3:a:auth0:auth0.js:*:*:*:*:*:node.js:*:* Versions 8.11.0 to before 10.0.0 Vulnerable ·auth0

Remediation

  • Fix · GHSA-8qjv-jj2q-x832 auth0-js (npm) Fixed in 10.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42280
  2. 2026-10-03 Alias added: GHSA-8qjv-jj2q-x832

References

Advisory 2

Other 1

  • TI-2018-05020 The Auth0 authentication service before 2017-10-15 allows privilege escalation because… CVSS 3.0CRITICAL 9.8
  • TI-2018-05300 The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the… CVSS 3.0HIGH 8.8
  • TI-2018-05021 CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. CVSS 3.0HIGH 8.8
  • TI-2020-11898 Authorization header is not sanitized in an error object in auth0 CVSS 3.1HIGH 7.7
  • TI-2017-12531 A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting… CVSS 3.0HIGH 7.5
  • TI-2020-04319 Information disclosure through error object CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences