GHSA-8qjv-jj2q-x832HighCVSS 7.1

Auth.js SDK has Improper Permission Checking

Published
May 6, 2026
Last Modified
June 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-42280 →

📋 Description

Description

Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided.

Am I Affected?

Users are affected if they meet each of the following preconditions:

  • Applications built using Auth0.js version between 8.11.0 and 9.32.0
  • The application’s access control relies on rules defined in Auth0 Actions.

Affected product and versions

auth0.js SDK v8.11.0 to v9.32.0

Resolution

Upgrade auth0/auth0.js to v10.0.0 or greater.

Acknowledgements

Okta would like to thank Quan Le (@aleister1102) for their discovery and responsible disclosure.

🎯 Affected products1

  • npm/auth0-js:>= 8.11.0, <= 9.32.0

🔗 References (3)