CVE-2026-84685

6.5 mediumEPSS 0.3%

Medium (6.5). EPSS 0.3% chance of exploitation in the next 30 days.

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory can be retrieved across subsequent requests processed by the same server runtime.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE: CWE-488
Published: 2026-09-08
Modified: 2026-09-10
Record from: the NVD, synced 2026-10-19

References

https://trust.okta.com/security-advisories/improper-cache-isolation-in-auth0-react-native-auth0-sdk-web-platform-credential-management-cve-2026-84685

Check your stack JSON