OktaOKTA-17PVWDJ

Improper Access Control in auth0-ai-js Document Retrieval CVE-2026-107372 - Nov 10, 2026

CVE-2026-107372 · Published Nov 10, 2026

Unrated

No fix yet

The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response. To remediate, upgrade @auth0/ai to version 6.0.3 or greater.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Details and references

Severity from: no source yet

More Okta advisories

All Okta

UnscoredNov 10

Improper Access Control in auth0-ai-python Document Retrieval CVE-2026-108167 - Nov 10...CVE-2026-108167no fix yet UnscoredNov 10

Improper Backchannel Session Revocation in the Auth0 ASP.NET Core Authentication SDK...CVE-2026-126129no fix yet UnscoredNov 10

Improper Input Validation of Path Parameters Auth0 Node.js SDK CVE-2026-126128 - Nov 10...CVE-2026-126128no fix yet Critical 9.8Oct 22

PHP Runtime Vulnerabilities Affecting Okta Access GatewayCVE-2026-109618no fix yet Critical 9.1Oct 22

Command Execution via Admin Console Input in Okta Access GatewayCVE-2026-115547no fix yet High 8.1Oct 22

Authentication Source Verification Issue in Okta Access GatewayCVE-2026-115546no fix yet