GitHub Advisoryadvisory · npm

GHSA-8qjv-jj2q-x832 Auth.js SDK has Improper Permission Checking

HIGH Published 2026-05-06 Modified 2026-06-08 Official page ↗
Aliases
CVE-2026-42280
Ecosystem
npm
Packages
auth0-js
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-863
Reviewed
2026-05-06

Affected packages

• npm auth0-js: >= 8.11.0, < 10.0.0 → fixed in 10.0.0

Description

Description Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. Am I Affected? Users are affected if they meet each of the following preconditions: • Applications built using Auth0.js version between 8.11.0 and 9.32.0 • The application’s access control relies on rules defined in Auth0 Actions. Affected product and versions auth0.js SDK v8.11.0 to v9.32.0 Resolution Upgrade auth0/auth0.js to v10.0.0 or greater. Acknowledgements Okta would like to thank Quan Le (@aleister1102) for their discovery and responsible disclosure.

Related

Alias · CVE (1)

  • CVE-2026-42280 Auth0.js is a client-side JavaScript library for Auth0. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References