Auth0.js client-side JavaScript library contains a vulnerability in versions 8.11.0 to 9.32.0 where the SDK may improperly return user profile information when provided with a valid access token and a specifically crafted invalid ID token. This authentication bypass vulnerability allows unauthorized access to user profile data under specific preconditions. The vulnerability has been patched in version 10.0.0. Organizations using affected versions should upgrade immediately to prevent potential unauthorized data exposure.