PT-2026-144762

CVE-2026-126128

·

Published

2026-11-10

·

Updated

2026-11-10

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.
Impacts
Vendors
Affected products
Weakness enumeration
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
CWE-706: Use of Incorrectly-Resolved Name or Reference
Related identifiers
CVE-2026-126128
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com