Vulnerabilidades do Auth0 Auth0.js

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Auth0 Auth0.js: 2 registro(s), com versões afetadas e correções.
cpe:2.3:a:auth0:auth0.js

CVE-2026-107371 Média · 5.4 CWE-613 13/10/2026

Missing Verification of auth_time Claim in auth0.js

When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.

CVE-2026-42280 Alta · 7.1 CWE-863 27/05/2026

Improper Permission Checking in Auth.js SDK

Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.