Improper Input Validation of Path Parameters Auth0 Node.js SDK CVE-2026-126128 - Nov 10, 2026

Description

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.

Affected product and versions

Customers using the Auth0 Node.js SDK versions 4.0.0 through 7.7.0 are affected.

Preconditions

The application passes a value that can be influenced by an externally supplied input as a path parameter to a Management API client method.
The token configured for the client holds sufficient scope for the endpoint the normalized request resolves to.

Customer Recommendations

To remediate this vulnerability, upgrade auth0/node-auth0 to version 7.7.1 or greater

Resolution

The vulnerability is present in auth0/node-auth0 versions 4.0.0 through 7.7.0, and is resolved in version 7.7.1.

CVE details

CVE ID	CVE-2026-126128
Published Date	2026-11-10
Vulnerability Type	Path Traversal (Dot-Segment Normalization during URL Assembly)
CWE	CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) CWE-706 (Use of Incorrectly-Resolved Name or Reference)
CVSS v3	Score: 6.5 Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P/RL:O/RC:C/CR:H/IR:M/AR:L

References

Improper Input Validation of Path Parameters Auth0 Node.js SDK