Auth0 Js
CVE-2018-6873
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.
AnalysisAI
The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated. Affected products include: Auth0 Auth0.Js. Version information: before 2017.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. Rated high sev
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. Rated high severit
The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the
In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request obj
auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. Rated medium s
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today