A logical flaw in the Auth0.js client‑side SDK causes it to return user profile information when a valid access token is supplied alongside a specially crafted invalid ID token. The bug exists in releases from 8.11.0 up through 9.32.0 and is classified as an access‑control logic error (CWE‑863). If exploited, an attacker could learn sensitive profile data without proper authorization.

The Auth0 JavaScript authentication library (auth0.js) is vulnerable in versions 8.11.0 through 9.32.0. Systems running these versions of the SDK are susceptible to the vulnerability unless they have migrated to later releases.

The CVSS score is 7.1, indicating a high risk level. No EPSS value is published, and the issue is not listed in CISA’s KEV catalog. Given the client‑side nature of the library, attackers would need to influence the ID token presented in a browser context; once done, the SDK’s improper permission check can expose confidential user profiles. The absence of a publicly documented exploit suggests the vulnerability is not widely leveraged yet, but the severity score warrants prompt remediation.