CVE-2026-84685

The record

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory can be retrieved across subsequent requests processed by the same server runtime.

Affected packages

Related vulnerabilities

• CVE-2026-114637 Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the… CWE-488
• CVE-2026-112921 Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter… CWE-488
• CVE-2026-86492 In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft… CWE-488
• CVE-2026-80231 A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given… CWE-488
• CVE-2026-82367 Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can… CWE-488
• CVE-2026-71850 Hono is a Web application framework that provides support for any JavaScript runtime. CWE-488
• CVE-2026-14621 A vulnerability has been found in FederatedAI FATE up to 2.2.0. CWE-488
• CVE-2026-54311 n8n is an open source workflow automation platform. CWE-488