Threats affecting pkg:npm/auth0/auth0.js

CVE-2026-107371 is a medium severity vulnerability in the Auth0 auth0.js library where the authorize() method does not properly validate the auth_time claim in the ID token against the requested maxAge parameter. This can cause applications to accept ID tokens representing authentication events older than intended, potentially weakening session expiration controls.

A vulnerability exists in Auth0.js versions 8.11.0 through 9.32.0 where, under specific conditions, the SDK may improperly return user profile information when presented with a valid access token and a specifically crafted invalid ID token. This incorrect authorization issue is identified as CWE-863 and is fixed in version 10.0.0. The vulnerability has a CVSS score of 7.