GitHub Advisoryadvisory · npm

GHSA-wpq7-q8j4-72jg Auth0-js bypasses CSRF checks

HIGH Published 2018-03-07 Modified 2022-04-25 Official page ↗
Aliases
CVE-2018-7307
Ecosystem
npm
Packages
auth0-js
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2020-06-16

Affected packages

• npm auth0-js: < 9.3.0 → fixed in 9.3.0

Description

The Auth0.js library has a vulnerability affecting versions below 9.3 that allows an attacker to bypass the CSRF check from the state parameter if it's missing from the authorization response, leaving the client vulnerable to CSRF attacks.

Related

Alias · CVE (1)

  • CVE-2018-7307 The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References