SB20261111122 - Path traversal in Auth0 Node.js SDK

Description

This security bulletin contains information about 1 vulnerability.

1) Path traversal (CVE-ID: CVE-2026-126128)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to access data or perform operations not intended by the application using its Management API token.

The vulnerability exists due to improper neutralization of path parameters in the Auth0 Node.js SDK Management API client when assembling URLs with externally influenced path parameters. A remote attacker can supply a crafted path parameter that undergoes dot-segment normalization to redirect a request and its attached Management API token to an unintended endpoint on the same tenant, enabling unintended access to data or operations.

Exploitation is limited to endpoints permitted by the configured Management API token's existing scopes.

Remediation

Install update from vendor's website.

References

• https://trust.okta.com/security-advisories/improper-input-validation-of-path-parameters-auth0-node-js-sdk-cve-2026-126128
• https://github.com/auth0/node-auth0/security/advisories/GHSA-h4ph-726g-66fc