HomepageOkta logo

Improper Permission Checking in Auth0.js SDK CVE-2026-42280 - May 6, 2026

View all security advisories

Description

Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided.

Affected versions

You are affected if you meet each of the following preconditions:

  • Applications built using Auth0.js version between 8.11.0 and 9.32.0

  • The application’s access control relies on rules defined in Auth0 Actions.

Resolution

Upgrade auth0/auth0.js to version 10.0.0 or greater.

Acknowledgements

Okta would like to thank Quan Le (@aleister1102) for their discovery and responsible disclosure.

CVE details

CVE ID

CVE-2026-42280

Published Date

2026-05-06

Vulnerability Type

Improper Permission Checking

CWE

CWE-863 - Incorrect Authorization

CVSS v3

Score: 7.1

Vector string: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

Improper Permission Checking in Auth0.js SDK