Auth0 Js
CVE-2018-6874
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1Blast Radius
ecosystem impact- 4 npm packages depend on auth0-js (2 direct, 2 indirect)
Ecosystem-wide dependent count for version 9.0.0.
DescriptionNVD
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
AnalysisAI
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. Affected products include: Auth0 Auth0.Js. Version information: through 14591.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. Rated high sev
The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated
The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the
In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request obj
auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. Rated medium s
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today