CVE-2018-6874
Cross-Site Request Forgery (CSRF) in Auth0
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
- Record
CVE-2018-6874- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
- Record
CVE-2018-6874- Updated
- 2026-11-02
EUVDEUVD-2018-0785 No score
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
- Record
EUVD-2018-0785- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wv26-rj8c-4r33
Cross-Site Request Forgery (CSRF) in Auth0
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
- Record
GHSA-wv26-rj8c-4r33- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
- Record
CVE-2018-6874- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-wv26-rj8c-4r33
Cross-Site Request Forgery (CSRF) in Auth0
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
- Record
GHSA-wv26-rj8c-4r33- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
auth0-jsnpm |
before 9.0.0 | 9.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-6874 is a high vulnerability (CVSS 8.8) in Auth0 Auth0.js, published April 4, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in auth0-js 9.0.0.