PT-2026-38263

CVE-2026-42280

Published

2026-05-06

Updated

2026-06-04

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions auth0-js versions 8.11.0 through 9.32.0

Description Improper validation in the Auth0.js SDK may allow the return of user profile data when a specifically crafted invalid ID token is used in conjunction with a valid access token. This issue occurs in applications where access control relies on rules defined in Auth0 Actions, potentially leading to unauthorized information disclosure.

Recommendations Update auth0-js to version 10.0.0 or greater.

Exploitability

Exploit

Fix

Impacts

Researchers

Aleister1102

Quan Le

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization