CVE-2026-126128: Path Traversal

Published Nov 10, 2026

Updated

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.

Affected Software

1 affected component

npm/auth0

Event History

Nov 10, 2026

CVE Published

via MITRE·09:09 PM

Data Sourced

via MITRE·09:09 PM

DescriptionWeakness

Data Sourced

via NVD·09:19 PM

DescriptionWeakness

Frequently Asked Questions

What conditions are required for exploitation?

An attacker would need to influence a path parameter used by the Auth0 Node.js SDK Management API client. The vulnerable request must carry a management API token, and the unintended endpoint is limited to the same Auth0 tenant.

How much access could an attacker gain?

The issue does not grant scopes beyond those already assigned to the attached management API token. However, it may allow use of those existing scopes against unintended data or management operations within the tenant.

CVE-2026-126128: Path Traversal

Affected Software

Event History

Frequently Asked Questions

What conditions are required for exploitation?

How much access could an attacker gain?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

How much access could an attacker gain?