{"id":"CVE-2026-126128","kind":"vulnerability","aliases":["CVE-2026-126128"],"related":[],"title":"Auth0 Node.js SDK: path parameters let a management token reach unintended endpoints","description":"The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.","summary":"The Management API client in the Auth0 Node.js SDK does not neutralize path parameters, so a request and its attached management API token can be redirected to a different endpoint on the same tenant. An attacker who can influence those path parameters can reach operations the token's existing scopes already permit.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["auth0","management-api","node.js","package"],"not_affected_if":["fixed-paths-only","no-management-api-client"],"how_to_check":"- Check the installed version with `npm ls auth0`\n- Search the codebase for calls to the Management API client that build paths from user-supplied input","fix":null,"status":"open","published_at":"2026-11-10T21:19:27+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","triaged_at":"2026-11-10T21:50:00+00:00","updated_at":"2026-11-10T21:50:00+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-10T21:50:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Auth0 Node.js SDK: path parameters let a management token reach unintended endpoints","impact":"medium","summary":"The Management API client in the Auth0 Node.js SDK does not neutralize path parameters, so a request and its attached management API token can be redirected to a different endpoint on the same tenant. An attacker who can influence those path parameters can reach operations the token's existing scopes already permit.","audience":"developers","category":"package","nicknames":[],"who_cares":["auth0","node.js","management-api"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reaches tenant endpoints the management token already permits","analyst_note":"Find affected and fixed SDK versions and the exact conditions for path parameter control in the Auth0 advisory or NVD entry.","how_to_check":"- Check the installed version with `npm ls auth0`\n- Search the codebase for calls to the Management API client that build paths from user-supplied input\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-management-api-client","fixed-paths-only"],"who_is_affected":"Applications that use the Auth0 Node.js SDK's Management API client and pass user-influenced values into path parameters are the likely exposure. Code that only uses the SDK's authentication flows with fixed paths is less likely to be affected. The sources do not list affected versions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4538,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126128':15A,18A '-2026':14A,17A 'access':113C 'allow':90C 'alreadi':75B,124C 'api':22B,27B,46B,79C,97C 'attach':44B,95C 'attack':60B 'auth0':1A,19B,31B,83C 'client':28B,80C 'cve':13A,16A 'data':115C 'differ':53B 'endpoint':12A,54B,105C 'exist':73B,122C 'improp':86C 'influenc':63B 'let':6A 'manag':8A,21B,26B,45B,78C,96C 'management-api':20B 'neutral':36B,87C 'node.js':2A,23B,32B,84C 'oper':69B,117C 'packag':24B 'paramet':5A,38B,66B,89C 'path':4A,37B,65B,88C 'permit':76B,125C 'reach':10A,68B 'redirect':50B,101C 'request':41B,92C 'result':110C 'scope':74B,123C 'sdk':3A,33B,85C 'tenant':58B,109C 'token':9A,47B,71B,98C,120C 'unintend':11A,104C,112C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Auth0 Node.js SDK's Management API client and pass user-influenced values into path parameters are the likely exposure. Code that only uses the SDK's authentication flows with fixed paths is less likely to be affected. The sources do not list affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["auth0","managementapi","nodejs","package","unknown"],"campaign_type":null,"search_a":"'-126128':15A,18A '-2026':14A,17A 'auth0':1A 'cve':13A,16A 'endpoint':12A 'let':6A 'manag':8A 'node.js':2A 'paramet':5A 'path':4A 'reach':10A 'sdk':3A 'token':9A 'unintend':11A","search_b":"'alreadi':75B 'api':22B,27B,46B 'attach':44B 'attack':60B 'auth0':19B,31B 'client':28B 'differ':53B 'endpoint':54B 'exist':73B 'influenc':63B 'manag':21B,26B,45B 'management-api':20B 'neutral':36B 'node.js':23B,32B 'oper':69B 'packag':24B 'paramet':38B,66B 'path':37B,65B 'permit':76B 'reach':68B 'redirect':50B 'request':41B 'scope':74B 'sdk':33B 'tenant':58B 'token':47B,71B","search_c":"'access':113C 'allow':90C 'alreadi':124C 'api':79C,97C 'attach':95C 'auth0':83C 'client':80C 'data':115C 'endpoint':105C 'exist':122C 'improp':86C 'manag':78C,96C 'neutral':87C 'node.js':84C 'oper':117C 'paramet':89C 'path':88C 'permit':125C 'redirect':101C 'request':92C 'result':110C 'scope':123C 'sdk':85C 'tenant':109C 'token':98C,120C 'unintend':104C,112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:19:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126128","severity":null,"published_at":"2026-11-10T21:19:27+00:00","modified_at":"2026-11-10T21:19:27+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","fetched_at":"2026-11-10T21:46:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}