Improper Permission Checking in Auth0.js SDK CVE-2026-42280 - May 6, 2026
Description
Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided.
Affected versions
You are affected if you meet each of the following preconditions:
Applications built using Auth0.js version between 8.11.0 and 9.32.0
The application’s access control relies on rules defined in Auth0 Actions.
Resolution
Upgrade auth0/auth0.js to version 10.0.0 or greater.
Acknowledgements
Okta would like to thank Quan Le (@aleister1102) for their discovery and responsible disclosure.
CVE details
CVE ID | |
Published Date | 2026-05-06 |
Vulnerability Type | Improper Permission Checking |
CWE | CWE-863 - Incorrect Authorization |
CVSS v3 | Score: 7.1 Vector string: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |