CVE-2026-108167
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.
| CWE | CWE-863 |
| Vendor | auth0 |
| Product | auth0-ai-langchain |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for auth0 auth0-ai-langchain
Be the first to know when new unknown vulnerabilities affecting auth0 auth0-ai-langchain are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Auth0 / auth0-ai-langchain
0 < 1.0.2
Auth0 / auth0-ai-llamaindex
0 < 1.0.3