Path traversal in Auth0 Node.js SDK - CVE-2026-126128
Published: November 11, 2026
Vulnerability identifier: #VU165701
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126128
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to access data or perform operations not intended by the application using its Management API token.
The vulnerability exists due to improper neutralization of path parameters in the Auth0 Node.js SDK Management API client when assembling URLs with externally influenced path parameters. A remote attacker can supply a crafted path parameter that undergoes dot-segment normalization to redirect a request and its attached Management API token to an unintended endpoint on the same tenant, enabling unintended access to data or operations.
Exploitation is limited to endpoints permitted by the configured Management API token's existing scopes.
Affected software
Auth0 Node.js SDK
How to mitigate CVE-2026-126128
Install security update from vendor's website.
Auth0 Node.js SDK - update to 7.7.1