auth0.js vulnerabilities

CVEs whose affected-version data names the auth0.js package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-107371Medium· 5.4

When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value

When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token t…

▾ SunlitAuth0 · auth0.jsEPSS 0.21%via NVD

auth0.js vulnerabilities (CVEs) · VulnSea