CVE-2026-42280

Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:auth0:auth0.js:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Auth0.js es una biblioteca JavaScript del lado del cliente para Auth0. Desde la versión 8.11.0 hasta la 9.32.0, bajo precondiciones específicas, el SDK de Auth0.js puede devolver incorrectamente información de perfil de usuario utilizando un token de acceso válido cuando se proporciona un token de ID no válido específicamente diseñado. Esta vulnerabilidad se corrige en la versión 10.0.0.

Information

Published : 2026-05-27 15:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-42280

Mitre link : CVE-2026-42280

CVE.ORG link : CVE-2026-42280

JSON object : View

Products Affected

auth0

auth0.js

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-42280", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42280", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-28T15:36:47.306227Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "auth0", "product": "auth0.js", "versions": [{"status": "affected", "version": ">= 8.11.0 , <= 9.32.0"}]}]}], "published": "2026-05-27T15:16:27.753", "references": [{"url": "https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0."}, {"lang": "es", "value": "Auth0.js es una biblioteca JavaScript del lado del cliente para Auth0. Desde la versi\u00f3n 8.11.0 hasta la 9.32.0, bajo precondiciones espec\u00edficas, el SDK de Auth0.js puede devolver incorrectamente informaci\u00f3n de perfil de usuario utilizando un token de acceso v\u00e1lido cuando se proporciona un token de ID no v\u00e1lido espec\u00edficamente dise\u00f1ado. Esta vulnerabilidad se corrige en la versi\u00f3n 10.0.0."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:auth0:auth0.js:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "F16E19EA-BB12-42DA-96ED-602A8FC930C0", "versionEndExcluding": "10.0.0", "versionStartIncluding": "8.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}