Description
The Auth0.js library has a vulnerability affecting versions below 9.3 that allows an attacker to bypass the CSRF check from the state parameter if it’s missing from the authorization response, leaving the client vulnerable to CSRF attacks.
Recommendation
Update the auth0-js package to the latest compatible version. Followings are version details:
- Affected version(s): < 9.3.0
- Patched version(s): 9.3.0
References
Could your website be exposed too?
SmartScanner can check your website for Auth0-js bypasses CSRF checks and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Cross-Site Request Forgery (CSRF) in Auth0 - CVE-2018-6874
- Information disclosure through error object in auth0.js - CVE-2020-5263
- auth0-js Privilege Escalation Vulnerability - CVE-2017-17068
- Auth0 angular-jwt misinterprets allowlist as regex - CVE-2018-11537
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023