{"id":"GHSA-8qjv-jj2q-x832","revision":"eb588dbfbe294b26a5bcfca52199ceba","records":[{"revision":"eb588dbfbe294b26a5bcfca52199ceba","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-8qjv-jj2q-x832","aliases":["CVE-2026-42280"],"title":"Auth.js SDK has Improper Permission Checking","description":"### Description\nUnder specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided.\n\n### Am I Affected?\nUsers are affected if they meet each of the following preconditions:\n- Applications built using Auth0.js version between 8.11.0 and 9.32.0\n- The application’s access control relies on rules defined in Auth0 Actions.\n\n\n### Affected product and versions\nauth0.js SDK v8.11.0 to v9.32.0\n\n### Resolution\nUpgrade auth0/auth0.js to v10.0.0 or greater.\n\n### Acknowledgements\nOkta would like to thank Quan Le (@aleister1102) for their discovery and responsible disclosure.","state":0,"publishedAt":"2026-05-06T17:05:14+00:00","modifiedAt":"2026-06-08T23:45:14.6331721+00:00","affected":[{"ecosystem":"npm","name":"auth0-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.11.0"},{"kind":"fixed","version":"10.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832","https://nvd.nist.gov/vuln/detail/CVE-2026-42280","https://github.com/auth0/auth0.js"],"sourceUrl":"https://github.com/advisories/GHSA-8qjv-jj2q-x832","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8qjv-jj2q-x832","identifiers":["GHSA-8qjv-jj2q-x832","CVE-2026-42280"]},"retained":false,"historicalAffected":[]}],"coverage":[]}