OktaOKTA-1BQAN08

Improper Input Validation of Path Parameters Auth0 Node.js SDK CVE-2026-126128 - Nov 10...

CVE-2026-126128 · Published Nov 10, 2026

Unrated

No fix yet

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit. To remediate, upgrade auth0/node-auth0 to version 7.7.1 or greater

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Details and references

Severity from: no source yet

More Okta advisories

All Okta

UnscoredNov 10

Improper Access Control in auth0-ai-python Document Retrieval CVE-2026-108167 - Nov 10...CVE-2026-108167no fix yet UnscoredNov 10

Improper Backchannel Session Revocation in the Auth0 ASP.NET Core Authentication SDK...CVE-2026-126129no fix yet UnscoredNov 10

Improper Access Control in auth0-ai-js Document Retrieval CVE-2026-107372 - Nov 10, 2026CVE-2026-107372no fix yet Critical 9.8Oct 22

PHP Runtime Vulnerabilities Affecting Okta Access GatewayCVE-2026-109618no fix yet Critical 9.1Oct 22

Command Execution via Admin Console Input in Okta Access GatewayCVE-2026-115547no fix yet High 8.1Oct 22

Authentication Source Verification Issue in Okta Access GatewayCVE-2026-115546no fix yet