Cross-Site Request Forgery (CSRF) in Auth0

Description

References

• nvd.nist.gov/vuln/detail/CVE-2018-6874 · ADVISORY
• auth0.com/docs/security/bulletins/cve-2018-6874 · WEB
• GitHub Advisory GHSA-wv26-rj8c-4r33 · ADVISORY
• securityfocus.com/bid/103695 · WEB

More vulnerabilities in auth0.js

• CVE-2026-42280HIGH 7.1Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly…
• CVE-2020-15125HIGH 7.7In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the…
• CVE-2020-5263MEDIUM 4.9auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication)…
• CVE-2018-6873CRITICAL 9.8The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.
• CVE-2018-7307HIGH 8.8The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.