Auth.js SDK has Improper Permission Checking
Description
Description
Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided.
Am
I Affected? Users are affected if they meet each of the following preconditions: - Applications built using Auth0.js version between 8.11.0 and 9.32.0 - The application’s access control relies on rules defined in Auth0 Actions.
### Affected product and versions auth0.js SDK v8.11.0 to v9.32.0
Resolution
Upgrade auth0/auth0.js to v10.0.0 or greater.
Acknowledgements
Okta would like to thank Quan Le (@aleister1102) for their discovery and responsible disclosure.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
auth0-jsnpm | >= 8.11.0, < 10.0.0 | 10.0.0 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.