CVE-2026-126128

Quick assessment

Affected

Auth0 Auth0 Node JS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Auth0 Node.js SDK 中的管理 API 客户端未能正确过滤路径参数，导致请求及其附带的管理 API 令牌被重定向到同一租户内的非预期端点，从而在令牌现有作用域已允许的情况下，造成对数据或操作的非预期访问。

AI Predicted 7.5 Difficulty: Easy Updated Nov 11, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Updated Nov 11, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Auth0	Auth0 Node JS	4.0.0 ~ 7.6.0	-

II. Public POCs for CVE-2026-126128

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126128

请登录查看更多情报信息。

Other References for CVE-2026-126128 (1)

http://trust.okta.com/security-advisories/improper-input-validation-of-path-parameters-auth0-node-js-sdk-cve-2026-126128

https://www.cve.org/CVERecord?id=CVE-2026-126128

Same Patch Batch · Auth0 · 2026-11-10 · 4 CVEs total

CVE-2026-108167		auth0-ai-python FGA 检索器越权漏洞
CVE-2026-107372		auth0-ai-js FGA检索器权限绕过漏洞
CVE-2026-126129		Auth0 SDK 错误处理 OIDC 注销导致未授权访问

IV. Related Vulnerabilities

Same vendor: Auth0

Same weakness: CWE-22