Executive brief
The react-native-auth0 SDK's web implementation does not properly isolate authentication tokens when used in server-side rendering environments where a single Node.js process handles requests from multiple users. An attacker could retrieve authentication tokens from other users' sessions cached in the server's memory, potentially gaining unauthorized access to their accounts and data.
Technical details
This is a cache isolation vulnerability (CWE-488) affecting the web platform implementation of the react-native-auth0 SDK. The SDK maintains an in-memory token cache that is not scoped to individual user sessions; when multiple users authenticate through the same Node.js SSR server process, their tokens persist in shared module state across HTTP requests. The vulnerability is triggered when the SDK is explicitly configured with useDPoP: false (disabling Demonstration of Proof-of-Possession protection). An attacker with network access to the web application can retrieve tokens cached from other users' sessions, leading to cross-session credential exposure. The vulnerability affects versions 5.0.0 through 5.11.0; a patch is available in version 5.11.1 and later.
Affected products
- Auth0 react-native-auth0 5.0.0 through 5.11.0
Timeline
- 2026-09-08: disclosed