CVE-2018-6874: CSRF
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the Legacy Lock API flag in Auth0 to remediate CSRF (described as existing through 14591 when the flag is enabled).
Auth0 authentication service Legacy Lock API flag = enabled -> disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2018-6874?
CVE-2018-6874 is classified as a high severity vulnerability due to its impact on authentication processes.
How do I fix CVE-2018-6874?
To fix CVE-2018-6874, disable the Legacy Lock API flag in your Auth0 configuration.
What causes CVE-2018-6874?
CVE-2018-6874 is caused by a Cross-Site Request Forgery (CSRF) vulnerability resulting from a flaw in the Auth0 authentication service.
Which versions are affected by CVE-2018-6874?
CVE-2018-6874 affects Auth0.js versions up to and including 8.12.1 when the Legacy Lock API flag is enabled.
Is CVE-2018-6874 exploitable?
Yes, CVE-2018-6874 is exploitable if an attacker can induce a user to perform actions without their consent while authenticated.