CVE-2026-42280: Improper Permission Checking in Auth.js SDK

Synopsis

An improper permission-checking vulnerability exists in the Auth0.js client-side JavaScript SDK (versions 8.11.0 through 9.32.0). The flaw is reachable over the network by any authenticated user with a low-privilege account, and requires no interaction from a victim. Under specific preconditions, an attacker can supply a crafted invalid ID token alongside a valid access token to cause the SDK to return user profile information it should not expose. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable SDK endpoint is exposed over the network, so an attacker must be able to reach the service remotely to deliver the crafted token payload.

• AuthenticationRequired

  The attacker must hold a valid access token, meaning at minimum a low-privilege account credential is necessary to trigger the flaw.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker submits the crafted request entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, specific memory layouts, or other environmental dependencies beyond meeting the preconditions described in the advisory.

Blast Radius

• Reads user profile information belonging to accounts other than the attacker's own, including any fields the SDK returns from the Auth0 user profile endpoint.
• Modifies the effective identity context seen by the application in a limited way, as the integrity impact is rated low, which may allow privilege boundary confusion within the session.
• Does not disrupt service availability; the confidentiality exposure is the primary harm.
• In applications that trust SDK-returned profile data to make authorization decisions, the attacker may gain access to resources or UI sections scoped to the impersonated user profile.