Login Request a demo
AU
Product
auth0.js
by auth0 · last CVE Oct 13, 2026
8
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 1High 5Medium 2Low 0
Severity
All severities8Critical1High5Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add auth0.js to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2018-6874
8.8
1%
Apr 4
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled
Affected: through 8.12.1
CVE-2018-7307
8.8
1%
Mar 6
The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter
Affected: before 9.3
CVE-2020-15125
7.7
2%
Jul 29
In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used
Affected: before 2.27.1
CVE-2017-17068
7.5
1%
Dec 6
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12
Affected: before 8.12
CVE-2026-42280
7.1
0%
May 27
Improper Permission Checking in Auth.js SDK
Affected: >= 8.11.0 , <= 9.32.0
Showing 5