Is CVE-2026-126128 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126128 being exploited in the wild.

How severe is CVE-2026-126128?

Informational severity, published 10 November 2026.

Which products and versions are affected?

Auth0 Node.js SDK 4.0.0 through 7.7.0.

Is there a fix for CVE-2026-126128?

Yes: fixed in 7.7.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126128 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126128?

Check whether you run Auth0 Node.js SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126128: Auth0 Node.js SDK path traversal in Management API client

CVE-2026-126128 · Severity: info · Published 2026-11-10

The Auth0 Node.js SDK's Management API client fails to properly validate path parameters, allowing an attacker to redirect API requests to unintended endpoints while reusing the management API token. If an application passes user-controlled input as a path parameter, an attacker could access or modify data that the token's permissions already allow, potentially exposing sensitive Auth0 tenant information or performing unauthorized operations.

Vendors: Auth0.

Quick answers

Is CVE-2026-126128 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126128 being exploited in the wild.
How severe is CVE-2026-126128?: Informational severity, published 10 November 2026.
Which products and versions are affected?: Auth0 Node.js SDK 4.0.0 through 7.7.0.
Is there a fix for CVE-2026-126128?: Yes: fixed in 7.7.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126128 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126128?: Check whether you run Auth0 Node.js SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 7.7.1

Technical details

The vulnerability is a path traversal flaw (CWE-22, CWE-706) in the Management API client that improperly neutralizes path parameters during URL assembly, allowing normalized requests to resolve to unintended endpoints on the same tenant. An attacker must supply input to a path parameter of a Management API method; successful exploitation requires the API token to hold sufficient scope for the redirected endpoint. The fix is available in version 7.7.1.

Affected products

Auth0 Node.js SDK 4.0.0 through 7.7.0

Timeline

2026-11-10: disclosed

References

http://trust.okta.com/security-advisories/improper-input-validation-of-path-parameters-auth0-node-js-sdk-cve-2026-126128

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.