Unrated severityNVD Advisory· Published Nov 10, 2026· Updated Nov 10, 2026

CVE-2026-126128

Description

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Auth0/Node.js SDKllm-create
Okta/Auth0 Node.js SDKllm-create

Patches

Vulnerability mechanics

References

trust.okta.com/security-advisories/improper-input-validation-of-path-parameters-auth0-node-js-sdk-cve-2026-126128nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000