1161 matches found
CVE-2026-126129
The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints...
CVE-2026-126128
The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes...
CVE-2026-108167
The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the...
CVE-2026-107372
The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response...
EUVD-2026-122940
The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints...
CVE-2026-126129
The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints...
CVE-2026-126129
The Auth0 ASP.NET Core Authentication SDK is affected by a vulnerability where it incorrectly determines the OIDC Back-Channel Logout status of a session. This flaw may allow a session that should have been terminated via back-channel logout to remain active, potentially granting unauthorized acc...
CVE-2026-126128
The Management API client in the Auth0 Node.js SDK is vulnerable to an improper neutralization of path parameters . This flaw allows a request and its associated management API token to be redirected to an unintended endpoint within the same tenant. Consequently, an attacker can gain unintended a...
CVE-2026-126128
The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes...
CVE-2026-108167
The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the...
CVE-2026-108167
The auth0-ai-python FGA retriever is vulnerable to an improper access control issue (CWE-863) during retrieval-augmented generation . The flaw exists because the retriever fails to distinguish between authorization checks for different users, relations, or conditions when filtering documents. Thi...
EUVD-2026-122933
The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the...
CVE-2026-107372
The auth0-ai-js FGA retriever is susceptible to an incorrect authorization vulnerability (CWE-863). The issue stems from the retriever's failure to distinguish between different authorization check conditions when filtering documents during retrieval-augmented generation . This allows documents t...
EUVD-2026-122931
The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response...
CVE-2026-107372
The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response...
PT-2026-144763
The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints...
CVE-2026-107372: Auth0 Auth0 AI JS: The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when…
The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response...
PT-2026-144736
The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response...
PT-2026-144737
The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the...
CVE-2026-108167: Auth0: The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations,…
The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the...