TI-2026-30591 CVE-2026-42280 · GHSA-8qjv-jj2q-x832
Improper Permission Checking in Auth.js SDK
Priority LOW 31
Auth0.js is a client-side JavaScript library for Auth0.
Vulnerabilities
7 records
TI-2020-11898 CVE-2020-15125 · GHSA-5jpf-pj32-xx53
Authorization header is not sanitized in an error object in auth0
Priority LOW 37
In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used.
TI-2020-04319 CVE-2020-5263 · GHSA-prfq-f66g-43mp
Information disclosure through error object
Priority LOW 26
auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability.
TI-2018-05021 CVE-2018-6874 · GHSA-wv26-rj8c-4r33
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
Priority LOW 39
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
TI-2018-05020 CVE-2018-6873 · GHSA-mc68-wpcg-f86r
The Auth0 authentication service before 2017-10-15 allows privilege escalation because…
Priority MEDIUM 46
The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.
TI-2018-05300 CVE-2018-7307 · GHSA-wpq7-q8j4-72jg
The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the…
Priority LOW 39
The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.
TI-2017-12531 CVE-2017-17068 · GHSA-3rpr-mg43-xhq4
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting…
Priority LOW 36
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12.