CVE-2017-17068

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.42%

Published

Dec 6, 2017

Modified

May 12, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback().

Weaknesses (CWE)

CWE-200

Affected Products (1)

auth0 · auth0.js (up to 8.12)vulnerable

References (4)

https://appcheck-ng.com/appcheck-discovers-vulnerability-auth0-library-cve-2017-17068/

ExploitIssue TrackingThird Party Advisory

https://auth0.com/docs/security/bulletins/cve-2017-17068

Issue TrackingVendor Advisory

https://appcheck-ng.com/appcheck-discovers-vulnerability-auth0-library-cve-2017-17068/

ExploitIssue TrackingThird Party Advisory

https://auth0.com/docs/security/bulletins/cve-2017-17068

Issue TrackingVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs