CVE-2026-126128
2026-11-10
21h19 +00:00
21h19 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Improper Limitation of a Pathname to a Restricted Directory The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
||
| Use of Incorrectly-Resolved Name or Reference The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. |
