AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

OktaOKTA-0HLWAI2

Improper Permission Checking in Auth0.js SDK

Okta

CVE-2026-42280 · Published May 6, 2026

High7.1
No fix yet
Okta advisory

Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. Upgrade auth0/auth0.js to version 10.0.0 or greater.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityOct 10Severity: Unrated to High
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Severity from
NVD

More Okta advisories

All Okta
Medium 6.6Sep 8Okta Access Gateway: code executionCVE-2026-78550fixed in 2026.9.1Medium 6.6Sep 8Okta Access Gateway: code injectionCVE-2026-78545fixed in 2026.9.1Medium 5.3Aug 25Okta Privileged Access Client: command injectionCVE-2026-77585fixed in 1.111.1Medium 6.5Jun 10Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDKCVE-2026-50157no fix yetMedium 5.4Apr 17Improper Proxy Cache Lookup in the Auth0 Next.js SDKCVE-2026-40155no fix yetHigh 8.2Apr 1Insufficient Entropy in Cookie Encryption in Auth0 Symfony SDKCVE-2026-34236no fix yet