Incorrect Authorization Affecting auth0-js package, versions >=8.11.0 <10.0.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Incorrect Authorization vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-AUTH0JS-16438973
- published7 May 2026
- disclosed6 May 2026
- creditQuan Le
Introduced: 6 May 2026
NewCVE-2026-42280 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade auth0-js to version 10.0.0 or higher.
Overview
auth0-js is an Auth0 headless browser sdk
Affected versions of this package are vulnerable to Incorrect Authorization via token validation. An attacker can gain unauthorized access to user profile information by providing a specifically crafted invalid ID token along with a valid access token.
Note: This is only exploitable if the application's access control relies on rules defined in Auth0 Actions.