---
id: CVE-2026-84685
title: >-
  The react-native-auth0 SDK's web platform implementation does not scope its
  in-memory token cache to individual user sessions when operating in a
  server-side rendering (SSR) environment where module state persists across
  HTTP requests
summary: >-
  The react-native-auth0 SDK's web platform implementation does not scope its
  in-memory token cache to individual user sessions when operating in a
  server-side rendering (SSR) environment where module state persists across
  HTTP requests. U…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-488
vendor: Auth0
product: react-native-auth0
affected:
  - react-native-auth0 >= 5.0.0 < 5.11.1
published: '2026-09-08'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T15:17:48.687'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84685'
references:
  - url: >-
      https://trust.okta.com/security-advisories/improper-cache-isolation-in-auth0-react-native-auth0-sdk-web-platform-credential-management-cve-2026-84685
    label: psirt@okta.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T14:44:19.402176Z'
epss: 0.00177
epssPercentile: 0.07502
ingestedAt: '2026-09-08T21:11:12.373Z'
---

## Overview

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory can be retrieved across subsequent requests processed by the same server runtime.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.