CVE-2018-6874

—

CVSS 3.0

8.8 high

EPSS

<1%p53

Published

Apr 4, 2018 (Apr 4, 2018)

Modified

Jun 17, 2026

Description

CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.

Vendors: auth0
Products: auth0.js
Weakness: CWE-352
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news2 stories

Authentication Bypass Vulnerability Found in Auth0 Identity Platform

The Hacker NewsApr 9, 18:01 UTC · Apr 9, 2018Vulnerability CVE-2018-6873 CVE-2018-6874

60

Auth0 authentication bypass issue exposed enterprises to hack

Security AffairsApr 8, 15:47 UTC · Apr 8, 2018Vulnerability CVE-2018-6873 CVE-2018-6874

60