Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Oct 13, 2026When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the CVE-2026-107371 · Other software · Auth0 · reported by psirt@okta.comMedium 5.4
When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.
- Product
- auth0.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtrust.okta.com
May 27, 2026Auth0.js is a client-side JavaScript library for Auth0.CVE-2026-42280 · Other software · auth0 · reported by GitHubHigh 7.1
Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.
- Product
- auth0.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2020auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability.CVE-2020-5263 · Other software · auth0 · reported by GitHubMedium 5.5
auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification, the application risks password exposure. This is fixed in version 9.12.3
- Product
- auth0.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2018CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.CVE-2018-6874 · Other software · Auth0 · reported by MITREHigh 8.8
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
- Product
- Auth0.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comauth0.com
Apr 4, 2018The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.CVE-2018-6873 · Other software · Auth0 · reported by MITRECritical 9.8
The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.
- Product
- Auth0.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comauth0.com
Mar 6, 2018The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.CVE-2018-7307 · Other software · Auth0 · reported by MITREHigh 8.8
The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.
- Product
- Auth0.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2017A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12.CVE-2017-17068 · Other software · Auth0 · reported by MITREHigh 7.5
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback().
- Product
- Auth0.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordappcheck-ng.comauth0.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.