Skip to content
OpenAdvisories

Package · npm

auth0-js

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.1
    CVE-2026-42280

    Improper Permission Checking in Auth.js SDK

    Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. T…

    auth0 auth0.js auth0-js npm
  • High 8.8
    CVE-2018-6874

    Cross-Site Request Forgery (CSRF) in Auth0

    CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.

    auth0-js npm
  • High 8.8
    CVE-2018-7307

    Auth0-js bypasses CSRF checks

    The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.

    auth0-js npm
  • High 7.5
    CVE-2017-17068

    auth0-js Privilege Escalation Vulnerability

    A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application use…

    auth0-js npm