CVE-2026-84685— Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management
Quick assessment
Affected
Auth0 react-native-auth0
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
react-native-auth0 SDK 的 Web 平台实现在服务器端渲染（SSR）环境中，未将其内存中的令牌缓存隔离到独立的用户会话。在这种模块状态会在 HTTP 请求之间保持存在的运行时环境下，根据所列前提条件，缓存在模块内存中的令牌可能会在由同一服务器运行时处理的后续请求中被检索到。
Possible ATT&CK Techniques 1 AI
T1529 · System Shutdown/Reboot
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84685
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management
Source: CVE Program / CVE List V5
Vulnerability Description
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory can be retrieved across subsequent requests processed by the same server runtime.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对错误会话暴露数据元素
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Auth0 | react-native-auth0 | 5.0.0 ~ 5.11.1 | - |
|
II. Public POCs for CVE-2026-84685
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84685
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-84685 (1)
Same Patch Batch · Auth0 · 2026-09-08 · 4 CVEs total
| CVE-2026-85982 | 9.0 CRITICAL | Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector |
| CVE-2026-85983 | 7.8 HIGH | Local Privilege Escalation in Auth0 AD/LDAP Connector |
| CVE-2026-85981 | 6.7 MEDIUM | Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector |
IV. Related Vulnerabilities
Same vendor: Auth0
-
CVE-2026-85983
Local Privilege Escalation in Auth0 AD/LDAP Connector -
CVE-2026-85982
Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector -
CVE-2026-85981
Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Conne -
CVE-2026-42280
Improper Permission Checking in Auth.js SDK -
CVE-2026-40155
Auth0 Next.js SDK has Improper Proxy Cache Lookup
Same weakness: CWE-488
-
CVE-2026-86492
JetBrains YouTrack 会话机制问题漏洞 -
CVE-2026-18489
IBM ContextForge Translate is affected by cross-client crede -
CVE-2026-82367
Re-entrant synchronous publish in AshGraphql subscription ba -
CVE-2026-71850
Hono: `memo()` retains SSR output across requests, leading t -
CVE-2026-16326
consul-mcp-server vulnerable to cross-tenant credential reus
V. Comments for CVE-2026-84685
No comments yet