CVE-2026-107372: Npm/auth0-ai-js vulnerability

Published Nov 10, 2026

Updated

The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.

Affected Software

1 affected component

npm/auth0-ai-js

Event History

Nov 10, 2026

CVE Published

via MITRE·09:05 PM

Data Sourced

via MITRE·09:05 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionWeakness

Frequently Asked Questions

What application setups are exposed to this issue?

Applications using the auth0-ai-js FGA retriever to filter documents during retrieval-augmented generation are exposed when authorization checks can occur under different conditions.

What does an attacker need to exploit the issue?

The issue concerns documents that Auth0 FGA denies under particular authorization-check conditions being included in the retrieval context because the retriever does not distinguish checks made under different conditions.

CVE-2026-107372: Npm/auth0-ai-js vulnerability

Affected Software

Event History

Frequently Asked Questions

What application setups are exposed to this issue?

What does an attacker need to exploit the issue?

Company

Resources

Contact

Frequently Asked Questions

What application setups are exposed to this issue?

What does an attacker need to exploit the issue?