Auth.js SDK has Improper Permission Checking
Description
Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided.
Am I Affected?
Users are affected if they meet each of the following preconditions:
- Applications built using Auth0.js version between 8.11.0 and 9.32.0
- The application’s access control relies on rules defined in Auth0 Actions.
Affected product and versions
auth0.js SDK v8.11.0 to v9.32.0
Resolution
Upgrade auth0/auth0.js to v10.0.0 or greater.
Acknowledgements
Okta would like to thank Quan Le (@aleister1102) for their discovery and responsible disclosure.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | auth0-js | >= 8.11.0, < 10.0.0 | 10.0.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N- Weakness (CWE)
CWE-863- Platform
- npm
- Package
auth0-js- Disclosed
- 06.05.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-8qjv-jj2q-x832 - CC BY 4.0
Vulnerability history: auth0-js
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 12.2017 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 5
Disclosures per year
- 2017: 1
- 2018: 2
- 2019: 0
- 2020: 1
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 1
-
Auth.js SDK has Improper Permission Checking this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.