CVE-2026-84685: Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory can be retrieved across subsequent requests processed by the same server runtime.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
auth0/react-native-auth0to a version that resolves this vulnerability.Fixed in 5.11.1
Event History
Frequently Asked Questions
Which deployments are exposed to cross-request token retrieval?
Deployments using the SDK's web platform implementation in a server-side rendering environment are exposed when module state persists across HTTP requests. In that condition, the in-memory token cache is not isolated to individual user sessions.
How can I determine whether my application is affected?
Check whether the application uses auth0/react-native-auth0 on the web in an SSR runtime that reuses the same server process or module state for subsequent requests. If tokens are cached in module memory under those conditions, tokens may be retrievable by later requests handled by that runtime.