CVE-2026-126128

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.

• CWE-22
• CWE-706

• https://trust.okta.com/security-advisories/improper-input-validation-of-path-parameters-auth0-node-js-sdk-cve-2026-126128

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126087Untrusted search path in the cross-user process launcher in …8.8
• CVE-2026-12609In Eclipse Theia versions 1.66.0 and up until including 1.73…7.5
• CVE-2026-1261The MetForm Pro plugin for WordPress is vulnerable to Stored…7.2
• CVE-2026-12610A flaw was found in sssd. When authenticating with a YubiKey…6.4
• CVE-2026-12611A client may issue HTTP/2 requests to a Jetty server that re…8.7
• CVE-2026-126123BeeS Software Solutions ERP before 04 September 2026 allows …6.5
• CVE-2026-126129The Auth0 ASP.NET Core Authentication SDK incorrectly determ…
• CVE-2026-12613Deserialization of untrusted data vulnerability in Ministry …8.8
• CVE-2026-126132When a message was forwarded inline, edited as new, or had a…
• CVE-2026-126133When a CalDAV or ICS calendar was accessed through an HTTP p…
• CVE-2026-126134Thunderbird allowed feed subscriptions to file: URLs that po…
• CVE-2026-126135If an attacker was able to perform a man-in-the-middle attac…