# CVE-2018-6874: Auth0 auth0-js Cross-Site Request Forgery in Legacy Lock API

Source: https://junglewise.ai/threats/cve-2018-6874-auth0-auth0-js-cross-site-request-forgery-in-legacy-lock-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-11-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-6874 · Severity: low · CVSS 3 · Published 2018-11-06

Auth0 is a widely used authentication service that handles user login for thousands of applications. A Cross-Site Request Forgery (CSRF) vulnerability in the auth0-js library could allow attackers to trick authenticated users into performing unwanted actions, such as changing account settings or granting permissions, without their knowledge or consent. This affects applications using the Legacy Lock API flag.

Technologies: [auth0-js (npm)](https://junglewise.ai/threats/technologies/auth0-js). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2018-6874 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-6874 being exploited in the wild.

**How severe is CVE-2018-6874?** Low severity, with a CVSS score of 3, published 6 November 2018.

**Which products and versions are affected?** auth0-js (npm) SEMVER:introduced=0,fixed=9.0.0.

**Is there a fix for CVE-2018-6874?** Yes. auth0-js (npm): upgrade to 9.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-6874 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2018-6874?** Check whether you run auth0-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- auth0-js (npm): upgrade to 9.0.0 or later

  ```sh
  npm install auth0-js@9.0.0
  ```


## Technical details

The vulnerability is a classic CSRF (CWE-352) in the Auth0 authentication service affecting auth0-js through version 14591, specifically when the Legacy Lock API flag is enabled. The attack requires user interaction (the victim must click a malicious link while authenticated) but no special privileges. An attacker can forge requests to perform actions on behalf of authenticated users. The vulnerability was patched in auth0-js version 9.0.0 and later. Detailed technical information is available in the Auth0 security bulletin CVE-2018-6874.

## Affected products

- Auth0 auth0-js before 9.0.0

## Identifiers

- CVE-2018-6874
- GHSA-wv26-rj8c-4r33

## Timeline

- 2018-11-06: disclosed
- 2018: patched: Fixed in auth0-js 9.0.0

## References

- [https://auth0.com/docs/security/bulletins/cve-2018-6874](https://auth0.com/docs/security/bulletins/cve-2018-6874)

## Related threats

- [Auth0 Auth0.js incorrect authorization in user profile retrieval](https://junglewise.ai/threats/cve-2026-42280-auth0-auth0-js-incorrect-authorization-in-user-profile-retrieval)
- [Auth0 auth0.js information disclosure in error object](https://junglewise.ai/threats/cve-2020-5263-auth0-auth0-js-information-disclosure-in-error-object)
- [Auth0 auth0-js CSRF bypass in state parameter validation](https://junglewise.ai/threats/cve-2018-7307-auth0-auth0-js-csrf-bypass-in-state-parameter-validation)
- [Auth0 auth0-js cross-origin token disclosure in popup callback](https://junglewise.ai/threats/cve-2017-17068-auth0-auth0-js-cross-origin-token-disclosure-in-popup-callback)