CVE-2026-126128

Not scored yetLast modified Nov 10, 2026

Description

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-22CWE-706

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Auth0Auth0 Node JS>= 4.0.0, < 7.6.0

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-126129The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-oCVE-2026-126138.8Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor onCVE-2026-126132When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment CVE-2026-126133When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the CVE-2026-126134Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, ThCVE-2026-126135If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could injectCVE-2026-126136For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even wCVE-2026-1261448.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throuCVE-2026-1261457.2A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throuCVE-2026-1261467.2A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throuCVE-2026-1261479.8A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FoCVE-2026-1261489.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throu
CVE-2026-126128: Unscored | Vulnix