Skip to content
OpenAdvisories

Product · auth0

auth0.js

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-107371

    Missing Verification of auth_time Claim in auth0.js

    When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an auth…

    auth0 auth0.js
  • Medium 5.5
    CVE-2020-5263

    Information disclosure through error object

    auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plain…

    auth0 auth0.js auth0-js npm