EUVD-2026-74189Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
AC:H reflects the SSR multi-user deployment requirement; C:H for full token disclosure; I:L for token-enabled impersonation actions; A:N as no availability impact exists.
Primary rating from Vendor (okta).
CVSS VectorVendor: okta
Lifecycle Timeline
2DescriptionCVE.org
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory can be retrieved across subsequent requests processed by the same server runtime.
AnalysisAI
Token cache isolation failure in react-native-auth0's web platform implementation exposes authentication tokens across user sessions when the SDK is deployed in server-side rendering (SSR) environments. Versions 5.0.0 through 5.11.0 cache OAuth/OIDC tokens at module scope - a singleton that persists across all HTTP requests handled by the same Node.js server process - meaning a token obtained during one user's request can be returned to a subsequent, unrelated request processed by the same runtime. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following conditions simultaneously: (1) the application uses react-native-auth0 version 5.0.0-5.11.0 with the web platform implementation (not the native mobile implementation); (2) the application is deployed in an SSR environment where module state persists across HTTP requests (e.g., a long-running Next.js or Remix server process, not per-request serverless isolation); and (3) multiple distinct authenticated users share the same server process instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, score 6.5) appropriately reflects both the severity of token disclosure and the elevated complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade react-native-auth0 to version 5.11.1 or later, which patches the token cache to scope storage per session or per request rather than at module scope. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-488 – Exposure of Data Element to Wrong Session
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today