GHSA-8QJV-JJ2Q-X832高危已审查

Auth.js SDK has Improper Permission Checking

OSV 1.4.0 · github-reviewed · 修改于 2026-06-09 07:41

发布时间

2026-05-07 01:05

GitHub 审查时间

2026-05-07 01:05

NVD 发布时间

2026-05-27 23:16

源文件

advisories/github-reviewed/2026/05/GHSA-8qjv-jj2q-x832/GHSA-8qjv-jj2q-x832.json

公告说明

Description

Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided.

Am I Affected?

Users are affected if they meet each of the following preconditions:

Applications built using Auth0.js version between 8.11.0 and 9.32.0
The application’s access control relies on rules defined in Auth0 Actions.

Affected product and versions

auth0.js SDK v8.11.0 to v9.32.0

Resolution

Upgrade auth0/auth0.js to v10.0.0 or greater.

Acknowledgements

Okta would like to thank Quan Le (@aleister1102) for their discovery and responsible disclosure.

受影响的软件包

npm

auth0-js

ECOSYSTEM

标识信息

别名 / CVE

CVE-2026-42280

CWE

CWE-863

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

原始 OSV JSON

{
  "id": "GHSA-8qjv-jj2q-x832",
  "aliases": [
    "CVE-2026-42280"
  ],
  "details": "### Description\nUnder specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided.\n\n### Am I Affected?\nUsers are affected if they meet each of the following preconditions:\n- Applications built using Auth0.js version between 8.11.0 and 9.32.0\n- The application’s access control relies on rules defined in Auth0 Actions.\n\n\n### Affected product and versions\nauth0.js SDK v8.11.0 to v9.32.0\n\n### Resolution\nUpgrade auth0/auth0.js to v10.0.0 or greater.\n\n### Acknowledgements\nOkta would like to thank Quan Le (@aleister1102) for their discovery and responsible disclosure.",
  "summary": "Auth.js SDK has Improper Permission Checking",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "8.11.0"
            },
            {
              "fixed": "10.0.0"
            }
          ]
        }
      ],
      "package": {
        "name": "auth0-js",
        "ecosystem": "npm"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 9.32.0"
      }
    }
  ],
  "modified": "2026-06-08T23:41:42Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
    }
  ],
  "published": "2026-05-06T17:05:14Z",
  "references": [
    {
      "url": "https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42280",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/auth0/auth0.js",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2026-05-27T15:16:27Z",
    "github_reviewed_at": "2026-05-06T17:05:14Z"
  }
}