CVE-2018-7307

—

CVSS 3.0

8.8 high

EPSS

<1%p42

Published

Mar 6, 2018 (Mar 6, 2018)

Modified

Jun 17, 2026

Description

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.

Vendors: auth0
Products: auth0.js
Weakness: CWE-352
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.