Description
The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | auth0-js | < 9.3.0 | 9.3.0 | GHSA-wpq7-q8j4-72jg |