Skip to content
OpenAdvisories

Package · npm

auth0-js

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • High 7.1
    CVE-2026-42280

    Improper Permission Checking in Auth.js SDK

    Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. T…

    auth0 auth0.js auth0-js npm
  • Medium 5.5
    CVE-2020-5263

    Information disclosure through error object

    auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plain…

    auth0 auth0.js auth0-js npm
  • High 8.8
    CVE-2018-6874

    Cross-Site Request Forgery (CSRF) in Auth0

    CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.

    auth0-js npm
  • High 8.8
    CVE-2018-7307

    Auth0-js bypasses CSRF checks

    The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.

    auth0-js npm
  • High 7.5
    CVE-2017-17068

    auth0-js Privilege Escalation Vulnerability

    A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application use…

    auth0-js npm