CVE-2026-107372
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.
| CWE | CWE-863 |
| Vendor | auth0 |
| Product | auth0 ai js |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for auth0 auth0 ai js
Be the first to know when new unknown vulnerabilities affecting auth0 auth0 ai js are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Auth0 / Auth0 AI JS
0 < 6.0.3