CVE-2018-7307: AUTH0 AUTH0.JS

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.

Affected products

• AUTH0 AUTH0.JS: before 9.3 (fixed in 9.3)

Published 2018-03-06. Last modified 2026-06-17.