auth0-js Privilege Escalation Vulnerability
High severity
GitHub Reviewed
Published
Dec 21, 2017
to the GitHub Advisory Database
•
Updated Sep 13, 2023
Description
Published by the National Vulnerability Database
Dec 6, 2017
Published to the GitHub Advisory Database
Dec 21, 2017
Reviewed
Jun 16, 2020
Last updated
Sep 13, 2023
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with
auth0.popup.callback().References