TI-2026-58220 Aliases CVE-2026-84685

Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management

LOW 29CWE-488Published 2026-09-08 · Updated 2026-09-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory can be retrieved across subsequent requests processed by the same server runtime.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00283 20th percentileScored 2026-11-07

Fix Fixed react-native-auth0 (Auth0): 5.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
auth0	react-native-auth0	5.0.0 to before 5.11.1	5.11.1	Patch available	CNA

react-native-auth0 Vendorauth0 Affected 5.0.0 to before 5.11.1 Fixed in 5.11.1 Patch available CNA

Remediation

Fix · CNA react-native-auth0 (Auth0) Fixed in 5.11.1

Timeline

2026-10-02 Threatist record created from CVE-2026-84685

References

Other 1

https://trust.okta.com/security-advisories/improper-cache-isolation-in-auth0-react-native-auth0-sdk-web-platform-credential-management-cve-2026-84685

TI-2015-07615 Improper input validation in HackerOne jsonwebtoken node module CVSS 3.0CRITICAL 9.8
TI-2025-29805 Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVSS 3.1CRITICAL 9.1
TI-2025-31089 Auth0-PHP SDK Deserialization of Untrusted Data vulnerability CVSS 4.0CRITICAL 9.3
TI-2020-06427 An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. CVSS 3.1CRITICAL 9.8
TI-2018-05020 The Auth0 authentication service before 2017-10-15 allows privilege escalation because… CVSS 3.0CRITICAL 9.8
TI-2019-05387 Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error… CVSS 3.0CRITICAL 9.8

See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences