CVE-2026-126128

— UNSCORED

Published 2026-11-10 · Updated 2026-11-10

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.

Weaknesses

CWE-22, CWE-706

All references

http://trust.okta.com/security-advisories/improper-input-validation-of-path-parameters-auth0-node-js-sdk-cve-2026-126128

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2012-20002PoC
HIGHCVE-2014-125130PoC
HIGHCVE-2014-125133PoC
HIGHCVE-2014-125134PoC
HIGHCVE-2015-20123PoC
HIGHCVE-2015-20124PoC
HIGHCVE-2015-20125PoC
HIGHCVE-2016-20100PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.