Description
The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.
Published: 2026-11-10
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:15:00 +0000

Type Values Removed Values Added
Description The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.
Weaknesses CWE-22
CWE-706
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Okta

Published:

Updated: 2026-11-10T21:09:20.724Z

Reserved: 2026-11-10T18:50:43.751Z

Link: CVE-2026-126128

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-10T21:19:27.440

Modified: 2026-11-10T21:19:27.440

Link: CVE-2026-126128

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-706

    Use of Incorrectly-Resolved Name or Reference