Auth0
Auth0.js: vulnerabilidades y CVE
Auth0.js tiene 7 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE7
Últimos 12 meses1
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-42280 | Alta (7.1) | 0.29% | — | 27 may 2026 | Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically… |
| CVE-2020-15125 | Alta (7.7) | 1.5% | — | 29 jul 2020 | In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in… |
| CVE-2020-5263 | Media (4.9) | 0.87% | — | 9 abr 2020 | auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request… |
| CVE-2018-6874 | Alta (8.8) | 0.74% | — | 4 abr 2018 | CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. |
| CVE-2018-6873 | Crítica (9.8) | 2.2% | — | 4 abr 2018 | The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated. |
| CVE-2018-7307 | Alta (8.8) | 0.51% | — | 6 mar 2018 | The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter. |
| CVE-2017-17068 | Alta (7.5) | 1.4% | — | 6 dic 2017 | A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's… |