---
id: "CVE-2026-126128"
page: "https://infrastack.ai/live/CVE-2026-126128"
kind: "vulnerability"
aliases: ["CVE-2026-126128"]
title: "Auth0 Node.js SDK: path parameters let a management token reach unintended endpoints"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["auth0", "management-api", "node.js", "package"]
not_affected_if: ["fixed-paths-only", "no-management-api-client"]
published_at: "2026-11-10T21:19:27+00:00"
first_seen_at: "2026-11-10T21:46:15+00:00"
updated_at: "2026-11-10T21:50:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126128", "first_seen_at": "2026-11-10T21:46:15+00:00"}]
exploit_sources: []
---

# Auth0 Node.js SDK: path parameters let a management token reach unintended endpoints

Link for people: https://infrastack.ai/live/CVE-2026-126128 (this .md is for agents)

The Management API client in the Auth0 Node.js SDK does not neutralize path parameters, so a request and its attached management API token can be redirected to a different endpoint on the same tenant. An attacker who can influence those path parameters can reach operations the token's existing scopes already permit.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls auth0`
- Search the codebase for calls to the Management API client that build paths from user-supplied input

## Timeline

- 2026-11-10T21:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126128

## From the sources

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_