auth0-js Privilege Escalation Vulnerability (GHSA-3rpr-mg43-xhq4)
Published: 2017-12-21T00:47:20Z
Aliases: CVE-2017-17068
Severity: HIGH · CWE: CWE-200

A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions &lt; 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with `auth0.popup.callback()`.

Affected packages:
package: ecosystem: npm
name: auth0-js
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 8.12.0