Auth0 vulnerabilities and fixes

CVEs that mention Auth0, ranked by priority. 5 tracked.

Auth0 has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2026-10-13. Highest priority: CVE-2026-85473 (score 30/100).

• CVE-2026-85473 MEDIUM 5.3 The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat)
• CVE-2026-42280 HIGH 7.1 UPGRADE Auth0.js is a client-side JavaScript library for Auth0
• CVE-2026-107369 MEDIUM 6.1 The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL
• CVE-2026-107370 MEDIUM 5.3 When a username for an Active Directory connection is a domain without a local part, the auth0-lock library in
• CVE-2026-107371 MEDIUM 5.4 When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth

FAQ

How do I fix Auth0 vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Auth0 being exploited right now?

None of the tracked Auth0 CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Auth0 CVE should I patch first?

CVE-2026-85473 currently ranks highest (30/100): The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) .

← Back to latest CVEs