CVE-2026-84685

Deferred Deferred - Pending Action

Authentication Token Exposure in react-native-auth0 SDK

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: Okta

Description

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory can be retrieved across subsequent requests processed by the same server runtime.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-84685

Affected Vendors & Products

Vendor	Product	Version / Range
auth0	react-native-auth0	From 5.0.0 (inc) to 5.11.0 (inc)
auth0	react-native-auth0	5.11.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-488	The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Attack-Flow Graph

Executive Summary

This vulnerability involves the react-native-auth0 SDK's web platform not properly isolating tokens in memory when used in a server-side rendering environment. Tokens cached for one user can be accessed by subsequent requests processed by the same server, leading to potential unauthorized access across user sessions.

Detection Guidance

To detect this vulnerability, check if your system uses the auth0/react-native-auth0 SDK in a Node.js SSR environment with versions between 5.0.0 and 5.11.0. Inspect server logs for multiple user sessions accessing cached tokens. Verify if the SDK is configured with useDPoP: false.

Impact Analysis

If you use the affected SDK versions in a Node.js SSR setup, an attacker could access cached tokens from other users who authenticated through the same server process. This could allow unauthorized access to user accounts or sensitive data, depending on the token permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with privacy regulations, and potential legal consequences for organizations handling protected user information.

Mitigation Strategies

Immediately upgrade the auth0/react-native-auth0 SDK to version 5.11.1 or later. If using Node.js SSR, ensure proper session isolation or disable module state persistence across requests. Review and restrict access to cached tokens in memory.

Hi! I’m here to help you understand CVE-2026-84685. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70