36 matches found
CVE-2026-42280
Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0...
CVE-2026-42280: Incorrect Authorization
Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0...
8base-js-sdk (>=0.1.0, <=0.1.6), 8base-react-sdk (>=0.37.2, <=2.6.6) +436 more potentially affected by CVE-2026-42280 via auth0-js (>=8.11.3, <=9.32.0)
auth0-js NPM version =8.11.3, =0.1.0, =0.37.2, =0.37.2, =1.0.1, =0.0.5, =0.0.0, =0.1.0, =0.37.2, =0.37.2, =0.37.2, =0.37.2, =0.37.2, =0.0.1, =0.4.1, =0.4.1, =3.1.0-beta.0 and more Source cves: CVE-2026-42280 Source advisory: SNYK:JS-AUTH0JS-16438973...
8base-js-sdk (>=0.1.0, <=0.1.6), 8base-react-sdk (>=0.37.2, <=2.6.6) +436 more potentially affected by CVE-2026-42280 via auth0-js (>=8.11.3, <=9.32.0)
auth0-js NPM version =8.11.3, =0.1.0, =0.37.2, =0.37.2, =1.0.1, =0.0.5, =0.0.0, =0.1.0, =0.37.2, =0.37.2, =0.37.2, =0.37.2, =0.37.2, =0.0.1, =0.4.1, =0.4.1, =3.1.0-beta.0 and more Source cves: CVE-2026-42280 Source advisory: OSV:GHSA-8QJV-JJ2Q-X832...
NPM: Auth.js SDK has Improper Permission Checking
NPM: Auth.js SDK has Improper Permission Checking vulnerability discovered by ? in WordPress Npm auth0-js versions = 8.11.0, = 9.32.0...
GHSA-8QJV-JJ2Q-X832 Auth.js SDK has Improper Permission Checking
Description Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. Am I Affected? Users are affected if they meet each of the following preconditions: - Applications built...
org.webjars.npm:angular-lock (2.0.3), org.webjars.npm:github-com-auth0-angular-auth0 (3.0.0) +1 more potentially affected by CVE-2026-42280 via org.webjars.npm:auth0-js (>=8.8.0, <=9.28.0)
org.webjars.npm:auth0-js MAVEN version =8.8.0, =9.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:auth0-js and may be impacted: - org.webjars.npm:angular-lock 2.0.3 - org.webjars.npm:github-com-auth0-angular-auth0 3.0.0 -...
PT-2026-38263
Name of the Vulnerable Software and Affected Versions auth0-js versions 8.11.0 through 9.32.0 Description Improper validation in the Auth0.js SDK may allow the return of user profile data when a specifically crafted invalid ID token is used in conjunction with a valid access token. This issue...
EUVD-2020-0389
Malware in sbrugna...
CVE-2020-5263
auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...
Information Disclosure
auth0.js is vulnerable to information disclosure. Error objects are returned by the library containing confidential information such as the original request of the user or the plaintext password entered by the user...
Information disclosure through error object in auth0.js
Overview Between versions 8.0.0 and 9.13.1inclusive, in the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification...
@apim/auth0-lock-redux (>=1.0.0, <=1.0.2), @auth0/cordova (>=0.1.0, <=0.2.0) +111 more potentially affected by CVE-2020-5263 via auth0-js (>=8.0.0-beta.1, <=9.13.1)
auth0-js NPM version =8.0.0-beta.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.1.0, =0.1.0-latest.1a450bb3, =1.4.5-next.1, =2.2.0, =1.0.0, =0.1.0, =0.3.0, =0.8.0 and more Source cves: CVE-2020-5263 Source advisory: OSV:GHSA-PRFQ-F66G-43MP...
GHSA-PRFQ-F66G-43MP Information disclosure through error object in auth0.js
Overview Between versions 8.0.0 and 9.13.1inclusive, in the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification...
CVE-2020-5263
auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...
CVE-2020-5263
auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...
Design/Logic Flaw
auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...
CVE-2020-5263
The CVE-2020-5263 entry concerns the Auth0.js (NPM package auth0-js) library. Affected versions are greater than 8.0.0 and before 9.12.3, where an authentication error returns an error object that may contain the user’s original request, potentially exposing the plaintext password if logged or ex...
CVE-2020-5263 Information disclosure through error object
auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...
CVE-2020-5263: Insufficiently Protected Credentials
auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...