Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Auth0 Node JS by Auth0

    CVE-2026-126128 (GCVE-0-2026-126128)

    Vulnerability from nvd – Published: 2026-11-10 21:09 – Updated: 2026-11-10 21:09
    VLAI
    Summary
    The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.
    Severity
    No CVSS data available.
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    • CWE-706 - Use of Incorrectly-Resolved Name or Reference
    Assigner
    Okta CNA under the mitre root
    CNA scorecard C 67/100 over 35 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Auth0 Auth0 Node JS Affected: 4.0.0 , < 7.6.0 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Auth0 Node JS",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "7.6.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token\u0027s existing scopes already permit."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-706",
              "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T21:09:20.724Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "http://trust.okta.com/security-advisories/improper-input-validation-of-path-parameters-auth0-node-js-sdk-cve-2026-126128"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-126128",
    "datePublished": "2026-11-10T21:09:20.724Z",
    "dateReserved": "2026-11-10T18:50:43.751Z",
    "dateUpdated": "2026-11-10T21:09:20.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-126128 (GCVE-0-2026-126128)

    Vulnerability from cvelistv5 – Published: 2026-11-10 21:09 – Updated: 2026-11-10 21:09
    VLAI
    Summary
    The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.
    Severity
    No CVSS data available.
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    • CWE-706 - Use of Incorrectly-Resolved Name or Reference
    Assigner
    Okta CNA under the mitre root
    CNA scorecard C 67/100 over 35 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Auth0 Auth0 Node JS Affected: 4.0.0 , < 7.6.0 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Auth0 Node JS",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "7.6.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token\u0027s existing scopes already permit."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-706",
              "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T21:09:20.724Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "http://trust.okta.com/security-advisories/improper-input-validation-of-path-parameters-auth0-node-js-sdk-cve-2026-126128"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-126128",
    "datePublished": "2026-11-10T21:09:20.724Z",
    "dateReserved": "2026-11-10T18:50:43.751Z",
    "dateUpdated": "2026-11-10T21:09:20.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}