Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. Am I Affected? Users are affected if they meet each of the following preconditions: - Applications built using Auth0.js version between 8.11.0 and 9.32.0 - The application’s access control relies on rules defined in Auth0 Actions. Affected product and versions auth0.js SDK v8.11.0 to v9.32.0 Resolution Upgrade auth0/auth0.js to v10.0.0 or greater. Acknowledgements Okta would like to thank Quan Le (@aleister1102) for their discovery and responsible disclosure.
Recommended action: Upgrade to 10.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Between versions 8.0.0 and 9.13.1(inclusive), in the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification, the application risks password exposure. Am I affected? You are affected by this vulnerability if all of the following conditions apply: - You are using Auth0.js version between 8.0.0 and 9.13.1(inclusive). - You store or display error objects without filtering. How to fix that? Developers should upgrade auth0.js to version 9.13.2 or later where user inputted passwords are masked in errors. If upgrading is not possible, a temporary fix may include not storing the error object or displaying it publicly without modification. Will this update impact my users? This fix patches the Auth0.js and may require changes in application code due to password no longer available in error object, but…
Recommended action: Upgrade to 9.13.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
Recommended action: Upgrade to 9.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Auth0.js library has a vulnerability affecting versions below 9.3 that allows an attacker to bypass the CSRF check from the state parameter if it's missing from the authorization response, leaving the client vulnerable to CSRF attacks.
Recommended action: Upgrade to 9.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback().
Recommended action: Upgrade to 8.12.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.