Auth0 Auth0.js vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Auth0 Auth0.js: 2 record(s), with affected versions and fixes.
cpe:2.3:a:auth0:auth0.js

CVE-2026-107371 Medium · 5.4 CWE-613 Oct 13, 2026

Missing Verification of auth_time Claim in auth0.js

When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.

CVE-2026-42280 High · 7.1 CWE-863 May 27, 2026

Improper Permission Checking in Auth.js SDK

Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.