@smg-automotive/auth (>=6.8.0-auth0-update-access-token-endpoint.1, <=9.3.5) potentially affected by CVE-2026-107369 via @auth0/nextjs-auth0 (>=4.9.0, <=4.25.0)

@auth0/nextjs-auth0 NPM version =4.9.0, =6.8.0-auth0-update-access-token-endpoint.1, =9.3.5 Source cves: CVE-2026-107369 Source advisory: SNYK:JS-AUTH0NEXTJSAUTH0-20936946...

CVE-2026-85473

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

CVE-2026-107369

The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...

CVE-2026-107371

When the authorize method is called with a maxAge parameter, the auth0.js library does not validate the authtime claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested...

CVE-2026-107370

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters...

CVE-2026-85473 Out-of-Range Timestamp Claim Handling in auth0/java-jwt

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

CVE-2026-85473

The auth0/java-jwt library is vulnerable to a flaw where it may terminate a thread upon receiving a JSON Web Token (JWT) containing an out-of-range value in timestamp claims such as exp , nbf , or iat . This issue occurs during the token parsing phase, specifically before signature verification t...

CVE-2026-107371

The auth0.js library contains a vulnerability where the authorize() method fails to validate the auth_time claim in the resulting ID token against the provided maxAge parameter. This flaw allows an application to potentially process an ID token representing an authentication event that is older t...

CVE-2026-107371 Missing Verification of auth_time Claim in auth0.js

When the authorize method is called with a maxAge parameter, the auth0.js library does not validate the authtime claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested...

CVE-2026-107370 Improper Request Handling for Active Directory Logins in auth0-lock

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters...

CVE-2026-107370

The auth0-lock library is vulnerable to improper request handling during Active Directory logins. When a username consists of a domain without a local part, the library incorrectly initiates the authentication transaction using a GET request instead of a POST request. This causes sensitive user-s...

CVE-2026-107369 Improper Validation of Post-Login Redirect URL in nextjs-auth0

The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...

CVE-2026-107369

The auth0/nextjs-auth0 SDK contains an open redirect vulnerability due to improper validation of the returnTo parameter. While the SDK initially validates that the parameter is a same-origin URL, the subsequent reconstruction logic can produce a URL that browsers interpret as an absolute or schem...

CVE-2026-107369

The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...

CVE-2026-107369 Improper Validation of Post-Login Redirect URL in nextjs-auth0

The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...

PT-2026-113366

🚨 CVE-2026-107370 When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string...

CVE-2026-85473: Improper Handling of Exceptional Conditions

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim exp, nbf, iat containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the...

CVE-2026-107371: Insufficient Session Expiration

When the authorize method is called with a maxAge parameter, the auth0.js library does not validate the authtime claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested...

CVE-2026-107370: Use of GET Request Method With Sensitive Query Strings

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters...

CVE-2026-107369: URL Redirection to Untrusted Site

The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...