CVE-2026-42280: Improper Permission Checking in Auth.js SDK
Description Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided.
Am I Affected? Users are affected if they meet each of the following preconditions: - Applications built using Auth0.js version between 8.11.0 and 9.32.0 - The application’s access control relies on rules defined in Auth0 Actions.
Affected product and versions auth0.js SDK v8.11.0 to v9.32.0
Resolution Upgrade auth0/auth0.js to v10.0.0 or greater.
Acknowledgements Okta would like to thank Quan Le (@aleister1102) for their discovery and responsible disclosure.
Other sources
Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42280?
CVE-2026-42280 is classified as a medium severity vulnerability due to its potential to expose sensitive user profile information.
How do I fix CVE-2026-42280?
To fix CVE-2026-42280, update the Auth0.js SDK to version 10.0.0 or later.
Who is affected by CVE-2026-42280?
Users are affected by CVE-2026-42280 if they are using Auth0.js SDK versions between 8.11.0 and 9.32.0.
What does CVE-2026-42280 allow attackers to do?
CVE-2026-42280 allows attackers to improperly access user profile information using a valid access token with a crafted invalid ID token.
Is CVE-2026-42280 present in all Auth0.js SDK versions?
No, CVE-2026-42280 is only present in specific versions of the Auth0.js SDK, namely between 8.11.0 and 9.32.0.