{"id":"EUVD-2026-32533","enisaUuid":"925a3b11-8b35-3f49-8fe1-eabb4e451b32","description":"Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.","datePublished":"May 27, 2026, 2:39:15 PM","dateUpdated":"May 28, 2026, 3:36:56 PM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832\n","aliases":"CVE-2026-42280\nGHSA-8qjv-jj2q-x832\n","assigner":"GitHub_M","epss":0.21,"enisaIdProduct":[{"id":"9bdef89e-8bf8-3f69-9fe6-077773abf361","product":{"name":"auth0.js","vendor":{"name":"auth0"}},"product_version":"8.11.0 , ≤ 9.32.0"}],"enisaIdVendor":[{"id":"e1500caa-281c-3860-953c-a681da2b17a5","vendor":{"name":"auth0"}}],"enisaIdVulnerability":[{"id":"5e8b8085-4d3e-39c4-8755-8deeb8bee8d3","vulnerability":{"id":"GHSA-8qjv-jj2q-x832","description":"Auth.js SDK has Improper Permission Checking","datePublished":"May 6, 2026, 5:05:14 PM","dateUpdated":"Jun 8, 2026, 11:41:42 PM","baseScore":0.0,"references":"https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42280\nhttps://github.com/auth0/auth0.js\n","enisa_id":"EUVD-2026-32533\n","aliases":"GHSA-8qjv-jj2q-x832\nCVE-2026-42280\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8fa9a896-31a2-306a-b51b-8ede38e3b114","vulnerability":{"id":"CVE-2026-42280","description":"Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.","datePublished":"May 27, 2026, 2:39:15 PM","dateUpdated":"May 28, 2026, 3:36:56 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832\n","enisa_id":"EUVD-2026-32533\n","assigner":"GitHub_M","epss":0.21,"dataProcessed":"Nov 1, 2026, 7:17:53 AM","vulnerabilityProduct":[{"id":"75527b20-3705-3337-9204-54a6461825ca","product":{"name":"auth0.js","vendor":{"name":"auth0"}},"product_version":"8.11.0 , ≤ 9.32.0"}],"vulnerabilityVendor":[{"id":"52ea8bf1-a1a0-359b-8294-6fbdcb1c2776","vendor":{"name":"auth0"}}]}}],"enisaIdAdvisory":[]}