CVE-2017-17068: Infoleak
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback().
Other sources
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-17068?
CVE-2017-17068 is classified as a high-severity vulnerability due to its potential to expose users' tokens.
How do I fix CVE-2017-17068?
To fix CVE-2017-17068, upgrade the auth0.js library to version 8.12.0 or higher.
What applications are affected by CVE-2017-17068?
CVE-2017-17068 affects versions of the auth0.js library prior to 8.12.0 that utilize popup callback pages.
What type of vulnerability is CVE-2017-17068?
CVE-2017-17068 is classified as a cross-origin vulnerability.
Who discovered CVE-2017-17068?
CVE-2017-17068 was disclosed by independent security researchers identifying risks associated with the auth0.js library.