Skip to content
OpenAdvisories
Unscored CVE-2026-107372 EUVD-2026-122931

The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during …

Published Nov 10, 2026 · Assigned by Okta

Description

The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.

Affected products

VendorProductAffectedFixed
auth0 Auth0 AI JS 0 <6.0.3 —

References