CVE-2026-84685

Executive Summary

CVE-2026-84685 describes a session-isolation failure in the react-native-auth0 SDK's web platform implementation when deployed in server-side rendering (SSR) environments. Under specific preconditions, the SDK's in-memory token cache is not scoped to individual user sessions; because module-level state persists across HTTP requests within the same server runtime, tokens cached during one user's session may be returned to subsequent, unrelated requests processed by the same runtime. The vulnerability carries a CVSS score of 6.5 (High-High confidentiality impact, Low integrity impact) under vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N. The affected component is the web platform implementation of react-native-auth0, but no specific version range has been disclosed by the CNA. No patch exists, no CISA KEV listing is present, and no known public PoC or in-the-wild exploitation has been reported.

Affected parties are organizations that deploy applications built with react-native-auth0 in an SSR mode (for instance, Next.js or similar React SSR frameworks) where the server runtime reuses module instances across incoming requests. The business impact centers on cross-user OAuth token leakage: an authenticated user's Auth0 access and refresh tokens could be exposed to an unrelated request, enabling token theft, unauthorized API access, and in some cases token-refresh operations that could extend an attacker's session persistence.

Technical Analysis

The react-native-auth0 SDK provides authentication primitives that wrap the Auth0 OAuth 2.0/OIDC flows. The NVD description specifies that the SDK's web platform implementation maintains an in-memory token cache. The flaw is rooted in the cache's lack of user-session scoping when the code executes in an SSR environment in which module state persists across HTTP requests.

To understand the mechanism: JavaScript modules in an SSR runtime (Node.js) are instantiated once per process. When a module declares a top-level variable — such as let cachedTokens = {} — that variable is shared across every request served by that process. In a typical SPA (single-page application), each user loads the JavaScript bundle into their own browser context, so a cache held in that module is per-browser, per-user. But under SSR, the same module instance serves all users. If the SDK's token cache is implemented at module scope and the cache key does not incorporate a per-session or per-user identifier (e.g., the OAuth state parameter or a session cookie), then a token persisted for User A remains in module memory and can be retrieved during User B's subsequent HTTP request.

The NVD description lists "listed preconditions" without enumerating them in the provided data. However, based on the described semantics, the necessary preconditions include: (1) the application uses react-native-auth0's web implementation in an SSR context; (2) the server runtime instantiates the module once and reuses it across requests; (3) the token cache is populated (i.e., at least one user has completed an Auth0 login flow); and (4) a later request to the same runtime triggers a cache lookup that does not verify session identity. The attack is network-reachable (AV:N) but requires high attack complexity (AC:H), likely because the attacker must time their request to coincide with a cached token from another user and must be able to trigger the vulnerable cache-read path without prior authentication (PR:N).

Insufficient technical detail is available regarding the exact internal function names, cache key construction, or the precise code path that performs the cache retrieval. The NVD description and CNA title do not expose these identifiers, and fabricating them would be speculative. The vulnerability class is CWE-488 (Exposure of Data Element to Wrong Session), which formally describes the scenario where data (tokens) captured during one session is accessible to a different session.

The CVSS sub-scores clarify the impact asymmetry: confidentiality impact is HIGH (C:H) because full OAuth tokens — which act as bearer credentials to the Auth0-protected APIs — can be exfiltrated. Integrity impact is LOW (I:L), potentially reflecting the ability to perform state-modifying API calls using the stolen token but at reduced scope. Availability is unaffected (A:N). The attack requires no privileges (PR:N) and no user interaction (UI:N), but the high complexity and the need for the vulnerable module state to be shared across requests temper the severity.

Exploitation Scenarios

No public PoC is available, and no exploit code has been observed in the wild; the attack chain below is inferred from the vulnerability class (CWE-488 — Exposure of Data Element to Wrong Session) and the described mechanism in the NVD entry.

1) Reconnaissance / Target Identification. An attacker identifies a target application that uses react-native-auth0 in an SSR deployment. Indicators include public client-side bundles referencing react-native-auth0, SSR-rendered HTML containing Auth0 authentication state, or an /.well-known/openid-configuration endpoint pointing to an Auth0 tenant. The attacker confirms the application performs token caching server-side by observing that consecutive unauthenticated requests to the same server process yield consistent authentication behavior (e.g., the absence of per-request session tokens in rendered HTML).

2) Triggering the Flaw Class. The attacker sends a crafted HTTP request to the server. Because the vulnerability is a session-isolation failure (CWE-488), the trigger is not a malformed payload but rather a legitimate request that lands on a server runtime whose module cache already contains a token from another user's session. The attacker must time their request after an authenticated victim has completed an Auth0 login flow on the same server instance. The attack complexity is high because the attacker must align their request with the victim's session lifecycle.

3) Payload / Execution Method. No malicious payload is injected. Instead, the attacker invokes the application's authentication-verification or token-retrieval code path — whichever endpoint or route causes the SDK to read from its module-level token cache — without presenting a valid session identifier. Due to the cache not being scoped to the victim's session, the server returns the cached token material in the HTTP response. At the vulnerability-class level, this is equivalent to session fixation or session confusion: the server confuses two distinct user contexts.

4) Post-Exploitation Impact. With the victim's Auth0 OAuth tokens (access token and potentially refresh token) in hand, the attacker can:

• Call any Auth0-protected API endpoint that accepts the stolen access token as a bearer credential (confidentiality breach, HIGH).
• If a refresh token was cached and is valid, the attacker can obtain fresh access tokens, potentially extending unauthorized access beyond the original token's expiry.
• In limited cases, the access token may allow state-changing operations on the victim's resources (integrity impact, LOW).
• The stolen tokens can be replayed from any network location, since OAuth bearer tokens are not bound to the original client IP.

The attack requires no authentication (PR:N) and no victim interaction after the initial login (UI:N), but the timing constraints and the requirement of a shared server runtime substantiate the high complexity rating.

Impact Assessment

Business Impact. The core impact is cross-tenant (or cross-user) disclosure of OAuth 2.0 bearer tokens in an SSR deployment. For enterprise applications using react-native-auth0 to protect internal APIs, this constitutes:

• Confidentiality (HIGH): An attacker can read protected user data, PII, financial records, or proprietary business data through any API that validates the stolen access token. Because the token is associated with the victim's identity, the attacker inherits the victim's full authorization scope.
• Integrity (LOW): Depending on the scopes granted during the OAuth flow, the attacker may be able to modify the victim's resources (e.g., updating a profile, posting content, altering configuration) using the stolen access token.
• Availability (NONE): The vulnerability does not directly enable denial-of-service; however, token revocation or forced re-authentication during incident response may cause temporary service interruptions.

Affected Systems. Any server-rendered web application that integrates react-native-auth0 is exposed when the Node.js runtime maintains module state across HTTP requests. This includes Next.js applications (with getServerSideProps or middleware performing Auth0 verification), Remix, and other SSR/metaframeworks, as well as custom Node.js HTTP servers that reuse a single bundled module for all requests.

Blast Radius. The vulnerability's reach depends on the number of concurrent users sharing a single server process. In horizontally scaled deployments where each process handles numerous sessions, the likelihood of an attacker's request colliding with another user's cached token increases. In single-process deployments, the entire user base is at risk. The CVSS scope is Unchanged (S:U), meaning a compromise of the token cache does not cross a trust boundary into other security domains — the impact stays within the authenticated application and the APIs it protects.

Known Exploitation. There is no evidence of in-the-wild exploitation as of the reporting date. The CISA KEV catalog lists this CVE as NO. EPSS has not yet produced a score (FIRST.org has not assessed it). No Nuclei template, exploit code, or public PoC repository has been identified.

Detection Guidance

The following detection rules target anomalous patterns consistent with exploitation of CVE-2026-84685: requests that receive cached token material without a corresponding session, or unexpected OAuth token usage from a single client IP across multiple user identities.

Sigma Rule

title: Auth0 Token Cache Session Confusion - CVE-2026-84685
id: 3f8c1d2e-4a5b-6c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects responses from SSR applications using react-native-auth0 that return cached OAuth tokens without a valid session identifier, indicating CVE-2026-84685 session-isolation failure.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-84685
author: Valtersit Threat Intelligence
date: 2026/06/15
logsource:
    category: application
    product: nodejs
    definition: 'Web application access logs from SSR servers running react-native-auth0'
detection:
    selection_response:
        cs-method:
            - 'GET'
            - 'POST'
        sc-status: '200'
        cs-uri-query|contains:
            - 'access_token'
            - 'id_token'
            - 'refresh_token'
        cs-uri-query|re:
            'token_type=bearer'
    selection_no_session:
        cs-uri-query|not|contains:
            - 'session='
            - 'sid='
        cs-uri-query|re:
            '^(?:(?!state=).)*$'
    filter_legit_auth_callback:
        cs-uri-query|contains: '/callback'
    condition: selection_response and selection_no_session and not filter_legit_auth_callback
    timeframe: 1m
level: high
falsepositives:
    - Legitimate server-side token refresh flows that omit client session state
    - Misconfigured proxies that strip session cookies from logs
fields:
    - c-ip
    - cs-uri-query
    - cs-host
tags:
    - attack.t1213
    - cve.2026-84685
    - cwe.488

YARA Rule

rule CVE_2026_84685_Auth0_Token_Cache_Session_Confusion
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects source code patterns indicative of module-level OAuth token caching without session scoping in react-native-auth0 SSR deployments."
        cve = "CVE-2026-84685"
        cwe = "CWE-488"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84685"
        date = "2026-06-15"
        severity = "high"
    strings:
        $s1 = "react-native-auth0" ascii nocase
        $s2 = "accessToken" ascii
        $s3 = "refreshToken" ascii
        $s4 = "tokenCache" ascii nocase
        $s5 = "module.exports" ascii
        $s5b = "export default" ascii
        $s6 = "getAccessToken" ascii
        $s7 = "tokenStorage" ascii nocase
        $s8 = "JSON.stringify" ascii
        $cache_pattern = { 63 61 63 68 65 20 3d 20 7b 7d } // "cache = {}"
        $top_level_let = { 6c 65 74 20 } // "let "
        $top_level_var = { 76 61 72 20 } // "var "
    condition:
        (uint16(0) == 0x4D5A or uint16(0) == 0x7F45) and
        (
            (all of ($s1, $s2, $s3, $s5, $s6)) or
            (all of ($s1, $s2, $s3, $s5b, $s6))
        ) and
        (
            $s4 or $s7 or $cache_pattern or
            ($top_level_let at 0 and $s8) or
            ($top_level_var at 0 and $s8)
        ) and
        not $genuine_scoped = "sessionStorage" ascii
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84685 Auth0 Token Cache Session Confusion Attempt"; flow:established,to_server; http.uri; content:"access_token"; http.uri; content:"token_type=bearer"; http.uri; content:!"state="; http.uri; content:!"error"; http.uri; content:"/api/"; classtype:attempted-recon; sid:202684685; rev:1; metadata:created_at 2026_06_15, cve CVE-2026-84685, cwe CWE-488, mitre_tactic T1213, mitre_technique Data_from_Information_Repositories, target_service http; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84685;)

Elastic Detection

// Detect repeated fetch of OAuth tokens from the same client IP across different user sessions
sequence by source.ip with maxspan=10m
  [http where request.method in ("GET", "POST") and
   url.path like "*token*" and
   url.query contains "access_token"]
  [http where request.method in ("GET", "POST") and
   response.status_code == 200 and
   url.path like "*api*" and
   url.query contains "access_token" and
   not url.query contains "session" and
   not url.query contains "sid"]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(cs_uri_query, "%access_token%") OR like(cs_uri_query, "%id_token%") OR like(cs_uri_query, "%refresh_token%")
| where NOT like(cs_uri_query, "%session=%") AND NOT like(cs_uri_query, "%sid=%")
| where status=200
| search NOT cs_uri_query="*callback*"
| stats count BY c_ip, cs_host, cs_uri_query, _time
| eventstats dc(user_agent) AS distinct_agents BY c_ip
| where distinct_agents > 5
| table _time, c_ip, cs_host, cs_uri_query, count, distinct_agents
| sort - _time

Wazuh OSSEC Rule

<group name="web, auth0, cve-2026-84685,">
  <rule id="846851" level="12">
    <decoded_as>json</decoded_as>
    <field name="url" type="pcre2">(?i)access_token=</field>
    <field name="url" type="pcre2">(?i)token_type=bearer</field>
    <field name="url" type="pcre2">(?-i)^(?:(?!state=).)*$</field>
    <field name="url" type="pcre2">(?-i)^(?:(?!callback).)*$</field>
    <description>CVE-2026-84685: OAuth token returned without session binding from react-native-auth0 SSR app</description>
    <group>authentication_failures,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
    <info type="cve">CVE-2026-84685</info>
    <info type="cwe">CWE-488</info>
    <options>no_full_log</options>
    <frequency>5</frequency>
    <timeframe>300</timeframe>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. No vendor fix, no version in the "Affected Versions" list, and no OSV package advisory is available. The CNA has not released a fix for react-native-auth0's web platform SSR implementation as of this report.

1) Immediate Mitigations:

• Disable SSR for authenticated pages. If the application serves authentication-protected content via server-side rendering, rearchitect so that token verification and retrieval occur on the client only. This removes the shared module-state exposure because the token cache then lives in the browser's per-user context, not the server process.
• Force per-request module isolation. In Node.js SSR frameworks, whenever feasible, load the react-native-auth0 module per-request (e.g., using dynamic import() inside the request handler) so that module state cannot persist across requests. This directly nulls the precondition "module state persists across HTTP requests."
• Do not persist tokens in module scope. Review application code that imports react-native-auth0: ensure no top-level const or let variables hold token values. Move token storage to a request-scoped store (e.g., an AsyncLocalStorage‑based context in Node.js) or to a session-bound external store (Redis, database) keyed by a server-generated session ID — never by module memory.
• Restrict server runtime concurrency. If SSR must remain enabled, deploy with one server process per session (impractical for scale) or ensure a load balancer pins a session to a single process AND each process only serves requests for that session (e.g., using sticky sessions tied to a single-user worker).
• Shorten OAuth token lifetimes. Reduce the access-token TTL and disable refresh tokens on the Auth0 tenant configuration to shrink the window during which a leaked token is usable. Force re-authentication frequently.

2) Patch / Upgrade Steps:

• Monitor the Auth0 open-source repository (github.com/auth0/react-native-auth0) and the Auth0 security advisory page for a version that scopes the web token cache per session. As of this writing, no such version exists.
• When a patched version is released, upgrade immediately and review the changelog to confirm the cache-scoping fix is present.
• After upgrading, regression-test SSR authentication flows to confirm session isolation across concurrent requests.

3) Long-Term Hardening:

• Adopt the principle of least privilege on Auth0 API tokens: grant access tokens only the minimal scopes required by each endpoint so that even a leaked token causes limited blast radius.
• Implement server-side token binding: configure Auth0 to issue tokens bound to a client certificate or mTLS connection where the OAuth server supports it, so a stolen token cannot be replayed from a different TLS context.
• Deploy anomaly detection on the protected APIs: monitor for a single source IP or user-agent using multiple access tokens corresponding to different user identities within a short window — the signature of a session-confusion attack.
• Conduct periodic code reviews searching for module-level mutable state in SSR server code (e.g., top-level let/var declarations holding authentication artifacts).
• Subscribe to CVE feeds and Auth0's security notifications to obtain immediate alerting when a patch lands.

Incident Response Consideration: If exploitation is suspected, assume all OAuth tokens cached since the vulnerable module was last reloaded may be compromised. Force a full token revocation on the Auth0 tenant and rotate all affected client secrets. Audit the server logs for signature-matching requests (see Detection Guidance) to scope the exposure window.

References

1. NVD Entry — CVE-2026-84685: https://nvd.nist.gov/vuln/detail/CVE-2026-84685 — Official NVD record with the description, CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N), and CWE-488 classification.
2. Auth0 react-native-auth0 GitHub Repository: https://github.com/auth0/react-native-auth0 — The vendor's source repository; monitors for disclosure of a patched version. No security advisory posted for this CVE as of the analysis date.
3. Auth0 Security Advisories (vendor): https://auth0.com/docs/secure/security-bulletin — Consolidated vendor security bulletins; will carry the official fix notice once released.
4. CWE-488 — Exposure of Data Element to Wrong Session: https://cwe.mitre.org/data/definitions/488.html — MITRE's classification reference describing the vulnerability class this CVE falls under.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Confirmed this CVE is NOT listed (NO KEV status as of reporting date), and no exploited-in-the-wild evidence has been published.

No active threat-actor campaigns, exploit-in-the-wild evidence, or public proof-of-concept code referencing CVE-2026-84685 has been identified as of this report. The vulnerability remains unpatched; continuous monitoring of the vendor repository and NVD is strongly recommended.