Login Request a demo
AU
Product
auth0.js
by auth0 · last CVE Oct 13, 2026
8
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 1High 5Medium 2Low 0
Severity
All severities8Critical1High5Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add auth0.js to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2018-6873
9.8
2%
Apr 4
The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated
Affected: through 8.10.1
CVE-2018-6874
8.8
1%
Apr 4
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled
Affected: through 8.12.1
CVE-2018-7307
8.8
1%
Mar 6
The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter
Affected: before 9.3
CVE-2020-15125
7.7
2%
Jul 29
In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used
Affected: before 2.27.1
CVE-2017-17068
7.5
1%
Dec 6
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12
Affected: before 8.12
CVE-2026-42280
7.1
0%
May 27
Improper Permission Checking in Auth.js SDK
Affected: >= 8.11.0 , <= 9.32.0
CVE-2026-107371
5.4
0%
Oct 13
Missing Verification of auth_time Claim in auth0.js
Affected: 9.12.0 before 10.3.0
CVE-2020-5263
4.9
1%
Apr 9
auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability
Affected: 8.0.0 through 9.13.1
Showing 8