Privilege Escalation Vulnerability in Auth0 Authentication Service
CVE-2018-6873

9.8CRITICAL

Key Information:

Vendor

Auth0

Status
Auth0.js
Vendor
CVE Published:
4 April 2018

What is CVE-2018-6873?

The Auth0 authentication service prior to October 15, 2017, contains a vulnerability that allows attackers to escalate privileges due to the lack of validation for the JSON Web Token (JWT) audience. This oversight means that unauthorized users could gain elevated access and perform actions that would normally be restricted, putting sensitive user data at risk. It is crucial for users of Auth0 to review their implementation and ensure secure token management to mitigate this risk.

References

http://www.securityfocus.com/bid/103695
vdb-entryx_refsource_BID
https://auth0.com/docs/security/bulletins/cve-2018-6873
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.