Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| auth0-js | npm | >= 8.11.0, <= 9.32.0 | 10.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability, described as 'Auth.js SDK has Improper Permission Checking', allows an attacker to retrieve user profile information by providing a valid access token with a specifically crafted invalid ID token. The analysis of the commits between the last vulnerable version (9.32.0) and the first patched version (10.0.0) revealed the exact location of the flaw.
The key commit, 9163b77c155e4824513a13f26d8c853535f74da1, titled 'fix: return validation error instead of falling back to /userinfo', pinpoints the vulnerable code. The changes are in the src/web-auth/index.js file, specifically within the WebAuth.prototype.validateAuthenticationResponse function.
The patch removes a significant block of code that handled a fallback mechanism. In the vulnerable versions, if the initial validation of the id_token failed, the code would check if the token's signing algorithm was HS256. If it was, and an access_token was also present in the authentication response, the SDK would make a call to the userInfo endpoint using that access_token. This fallback logic is the root cause of the vulnerability. It incorrectly assumes that a valid access token can be trusted to fetch user information even when the accompanying ID token is invalid.
The fix is to remove this fallback entirely. After the patch, any id_token validation error results in an immediate callback with the error, preventing the call to the userInfo endpoint. Therefore, the function WebAuth.validateAuthenticationResponse is the vulnerable function, as it contains the logic that improperly processes the authentication response and leads to the information disclosure.
