Insecure Token Management in react-native-auth0 SDK Web Platform by Auth0

CVE-2026-84685

What is CVE-2026-84685?

The react-native-auth0 SDK's implementation on the web platform harbors a significant vulnerability due to the improper isolation of its in-memory token cache. This issue is particularly concerning in server-side rendering (SSR) environments, where module state persists across HTTP requests. As a result, tokens cached in the module's memory may be accessible across different user sessions, compromising user security and leading to potential unauthorized access. The vulnerability emphasizes the importance of robust session management and token isolation in web applications to protect sensitive information.

References