Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-126129 (GCVE-0-2026-126129)

Vulnerability from nvd – Published: 2026-11-10 21:14 – Updated: 2026-11-10 21:14

Summary

The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.

Severity

No CVSS data available.

CWE

CWE-807 - Reliance on Untrusted Inputs in a Security Decision
CWE-287 - Improper Authentication
CWE-1254 - Incorrect Comparison Logic Granularity

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/improp…

Impacted products

1 product

Vendor	Product	Version
Auth0	Auth0 ASP.NET Core Authentication	Affected: 0 , < 1.12.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Auth0 ASP.NET Core Authentication",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "1.12.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session\u0027s OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-807",
              "description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1254",
              "description": "CWE-1254: Incorrect Comparison Logic Granularity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T21:14:09.582Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-126129",
    "datePublished": "2026-11-10T21:14:09.582Z",
    "dateReserved": "2026-11-10T18:52:30.790Z",
    "dateUpdated": "2026-11-10T21:14:09.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126128 (GCVE-0-2026-126128)

Vulnerability from nvd – Published: 2026-11-10 21:09 – Updated: 2026-11-10 21:09

Summary

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.

Severity

No CVSS data available.

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-706 - Use of Incorrectly-Resolved Name or Reference

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
http://trust.okta.com/security-advisories/imprope…

Impacted products

1 product

Vendor	Product	Version
Auth0	Auth0 Node JS	Affected: 4.0.0 , < 7.6.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Auth0 Node JS",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "7.6.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token\u0027s existing scopes already permit."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-706",
              "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T21:09:20.724Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "http://trust.okta.com/security-advisories/improper-input-validation-of-path-parameters-auth0-node-js-sdk-cve-2026-126128"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-126128",
    "datePublished": "2026-11-10T21:09:20.724Z",
    "dateReserved": "2026-11-10T18:50:43.751Z",
    "dateUpdated": "2026-11-10T21:09:20.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108167 (GCVE-0-2026-108167)

Vulnerability from nvd – Published: 2026-11-10 21:07 – Updated: 2026-11-10 21:07

Summary

The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.

Severity

No CVSS data available.

CWE

CWE-863 - Incorrect Authorization

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/improp…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Auth0	auth0-ai-langchain	Affected: 0 , < 1.0.2 (python)
Auth0	auth0-ai-llamaindex	Affected: 0 , < 1.0.3 (python)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org",
          "defaultStatus": "unaffected",
          "packageName": "auth0-ai-langchain",
          "product": "auth0-ai-langchain",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "1.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        },
        {
          "collectionURL": "https://pypi.org",
          "defaultStatus": "unaffected",
          "packageName": "auth0-ai-llamaindex",
          "product": "auth0-ai-llamaindex",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "1.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T21:07:56.515Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://trust.okta.com/security-advisories/improper-access-control-in-auth0-ai-python-document-retrieval-cve-2026-108167"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-108167",
    "datePublished": "2026-11-10T21:07:56.515Z",
    "dateReserved": "2026-10-09T15:53:50.156Z",
    "dateUpdated": "2026-11-10T21:07:56.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107372 (GCVE-0-2026-107372)

Vulnerability from nvd – Published: 2026-11-10 21:05 – Updated: 2026-11-10 21:05

Summary

The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.

Severity

No CVSS data available.

CWE

CWE-863 - Incorrect Authorization

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/improp…

Impacted products

1 product

Vendor	Product	Version
Auth0	Auth0 AI JS	Affected: 0 , < 6.0.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Auth0 AI JS",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "6.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T21:05:47.870Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/improper-access-control-in-auth0-ai-js-document-retrieval-cve-2026-107372"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-107372",
    "datePublished": "2026-11-10T21:05:47.870Z",
    "dateReserved": "2026-10-07T20:59:28.991Z",
    "dateUpdated": "2026-11-10T21:05:47.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85473 (GCVE-0-2026-85473)

Vulnerability from nvd – Published: 2026-10-13 20:08 – Updated: 2026-10-16 15:31

Title

Out-of-Range Timestamp Claim Handling in auth0/java-jwt

Summary

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:26 UTC

CWE

CWE-755 - Improper Handling of Exceptional Conditions
CWE-20 - Improper Input Validation

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

2 references

URL	Tags
https://trust.okta.com/security-advisories/out-of…
https://github.com/auth0/java-jwt/security/adviso…

Impacted products

1 product

Vendor	Product	Version
Auth0	java-jwt	Affected: 4.0.0 , < 4.6.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85473",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:26:02.693134Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:31:55.100Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "java-jwt",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "4.6.2",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "Improper Handling of Exceptional Conditions",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T20:15:27.938Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/out-of-range-timestamp-claim-handling-in-auth0-java-jwt-cve-2026-85473"
        },
        {
          "url": "https://github.com/auth0/java-jwt/security/advisories/GHSA-cg7w-5cc2-f2xm"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade auth0/java-jwt to version 4.6.2 or greater."
        }
      ],
      "title": "Out-of-Range Timestamp Claim Handling in auth0/java-jwt"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-85473",
    "datePublished": "2026-10-13T20:08:56.332Z",
    "dateReserved": "2026-09-03T20:12:16.623Z",
    "dateUpdated": "2026-10-16T15:31:55.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107371 (GCVE-0-2026-107371)

Vulnerability from nvd – Published: 2026-10-13 20:08 – Updated: 2026-10-14 18:40

Title

Missing Verification of auth_time Claim in auth0.js

Summary

When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 18:40 UTC

CWE

CWE-613 - Insufficient Session Expiration

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

2 references

URL	Tags
https://trust.okta.com/security-advisories/missin…
https://github.com/auth0/auth0.js/security/adviso…

Impacted products

1 product

Vendor	Product	Version
Auth0	auth0.js	Affected: 9.12.0 , < 10.3.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:40:16.045683Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:40:31.506Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "auth0.js",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "10.3.0",
              "status": "affected",
              "version": "9.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "Insufficient Session Expiration",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T20:14:25.368Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/missing-verification-of-auth_time-claim-in-auth0-js-cve-2026-107371"
        },
        {
          "url": "https://github.com/auth0/auth0.js/security/advisories/GHSA-42v6-5rcc-mq4v"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade auth0.js to version 10.3.0 or greater."
        }
      ],
      "title": "Missing Verification of auth_time Claim in auth0.js"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-107371",
    "datePublished": "2026-10-13T20:08:21.898Z",
    "dateReserved": "2026-10-07T20:59:27.478Z",
    "dateUpdated": "2026-10-14T18:40:31.506Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107370 (GCVE-0-2026-107370)

Vulnerability from nvd – Published: 2026-10-13 20:08 – Updated: 2026-10-14 18:41

Title

Improper Request Handling for Active Directory Logins in auth0-lock

Summary

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 18:40 UTC

CWE

CWE-598 - Use of GET Request Method With Sensitive Query Strings
CWE-532 - Insertion of Sensitive Information into Log File

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

2 references

URL	Tags
https://trust.okta.com/security-advisories/improp…
https://github.com/auth0/lock/security/advisories…

Impacted products

1 product

Vendor	Product	Version
Auth0	auth0-lock	Affected: 10.9.0 , < 13.2.1 (semver) Affected: 14.0.0 , < 15.0.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107370",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:40:51.235220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:41:04.775Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "auth0-lock",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "13.2.1",
              "status": "affected",
              "version": "10.9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.0.2",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "Use of GET Request Method With Sensitive Query Strings",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "Insertion of Sensitive Information into Log File",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T20:14:48.506Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/improper-request-handling-for-active-directory-logins-in-auth0-lock-cve-2026-107370"
        },
        {
          "url": "https://github.com/auth0/lock/security/advisories/GHSA-mp8m-wcxp-w648"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade auth0-lock to version 13.2.1, or version 15.0.2 or greater."
        }
      ],
      "title": "Improper Request Handling for Active Directory Logins in auth0-lock"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-107370",
    "datePublished": "2026-10-13T20:08:09.635Z",
    "dateReserved": "2026-10-07T20:59:25.866Z",
    "dateUpdated": "2026-10-14T18:41:04.775Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107369 (GCVE-0-2026-107369)

Vulnerability from nvd – Published: 2026-10-13 20:08 – Updated: 2026-10-14 18:41

Title

Improper Validation of Post-Login Redirect URL in nextjs-auth0

Summary

The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path, leading to a redirect to an unintended domain.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 18:41 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

2 references

URL	Tags
https://trust.okta.com/security-advisories/improp…
https://github.com/auth0/nextjs-auth0/security/ad…

Impacted products

1 product

Vendor	Product	Version
Auth0	nextjs-auth0	Affected: 0 , < 4.32.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:41:22.614149Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:41:32.403Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "nextjs-auth0",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "4.32.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path, leading to a redirect to an unintended domain."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T20:15:54.239Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/improper-validation-of-post-login-redirect-url-in-nextjs-auth0-cve-2026-107369"
        },
        {
          "url": "https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-5vvp-h2v6-59j6"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade auth0/nextjs-auth0 to version 4.32.0 or greater."
        }
      ],
      "title": "Improper Validation of Post-Login Redirect URL in nextjs-auth0"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-107369",
    "datePublished": "2026-10-13T20:08:00.543Z",
    "dateReserved": "2026-10-07T20:59:17.368Z",
    "dateUpdated": "2026-10-14T18:41:32.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-50157 (GCVE-0-2026-50157)

Vulnerability from nvd – Published: 2026-09-14 17:06 – Updated: 2026-09-14 20:06

Title

Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK

Summary

Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as the Authorization header for protected HTTP routes. Query-string tokens can be recorded in server logs, browser history, or referrer data and then replayed against protected API endpoints. This issue is fixed in version 5.9.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 19:20 UTC

CWE

CWE-598 - Use of GET Request Method With Sensitive Query Strings

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7763 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/auth0/symfony/security/advisor…	x_refsource_CONFIRM
https://github.com/auth0/symfony/commit/bd1851b14…	x_refsource_MISC
https://github.com/auth0/symfony/releases/tag/5.9.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
auth0	symfony	Affected: >= 5.0.0-BETA0, < 5.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50157",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T19:20:53.714296Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T20:06:21.452Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "symfony",
          "vendor": "auth0",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-BETA0, \u003c 5.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as the Authorization header for protected HTTP routes. Query-string tokens can be recorded in server logs, browser history, or referrer data and then replayed against protected API endpoints. This issue is fixed in version 5.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "CWE-598: Use of GET Request Method With Sensitive Query Strings",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:06:23.237Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/auth0/symfony/security/advisories/GHSA-ffq7-hh2j-r24p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/auth0/symfony/security/advisories/GHSA-ffq7-hh2j-r24p"
        },
        {
          "name": "https://github.com/auth0/symfony/commit/bd1851b14ae15e99cbe87c96496cf25da025288a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/auth0/symfony/commit/bd1851b14ae15e99cbe87c96496cf25da025288a"
        },
        {
          "name": "https://github.com/auth0/symfony/releases/tag/5.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/auth0/symfony/releases/tag/5.9.0"
        }
      ],
      "source": {
        "advisory": "GHSA-ffq7-hh2j-r24p",
        "discovery": "UNKNOWN"
      },
      "title": "Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50157",
    "datePublished": "2026-09-14T17:06:23.237Z",
    "dateReserved": "2026-06-03T20:54:20.432Z",
    "dateUpdated": "2026-09-14T20:06:21.452Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85983 (GCVE-0-2026-85983)

Vulnerability from nvd – Published: 2026-09-08 20:18 – Updated: 2026-09-10 14:43

Title

Local Privilege Escalation in Auth0 AD/LDAP Connector

Summary

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 14:43 UTC

CWE

CWE-94 - Improper Control of Generation of Code

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/local-…

Impacted products

1 product

Vendor	Product	Version
Auth0	Auth0 AD/LDAP Connector	Affected: 0 , ≤ 6.5.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85983",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T14:43:45.813987Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T14:43:59.925Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Auth0 AD/LDAP Connector",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThanOrEqual": "6.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector\u0027s configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T20:18:09.381Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/local-privilege-escalation-in-auth0-ad-ldap-connector-cve-2026-85983"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade the auth0/ad-ldap-connector to version 7.00 or greater."
        }
      ],
      "title": "Local Privilege Escalation in Auth0 AD/LDAP Connector"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-85983",
    "datePublished": "2026-09-08T20:18:09.381Z",
    "dateReserved": "2026-09-04T19:04:28.553Z",
    "dateUpdated": "2026-09-10T14:43:59.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85982 (GCVE-0-2026-85982)

Vulnerability from nvd – Published: 2026-09-08 20:17 – Updated: 2026-09-10 14:43

Title

Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector

Summary

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs.

Severity

9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 14:43 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/stored…

Impacted products

1 product

Vendor	Product	Version
Auth0	Auth0 AD/LDAP Connector	Affected: 0 , ≤ 6.5.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85982",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T14:43:01.622324Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T14:43:17.196Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Auth0 AD/LDAP Connector",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThanOrEqual": "6.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator\u0027s browser when they view the affected search results or update logs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T20:17:40.063Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/stored-cross-site-scripting-xss-in-auth0-ad-ldap-connector-cve-2026-85982"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade the Auth0 AD/LDAP Connector to version 7.0.0 or greater."
        }
      ],
      "title": "Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-85982",
    "datePublished": "2026-09-08T20:17:40.063Z",
    "dateReserved": "2026-09-04T19:03:24.108Z",
    "dateUpdated": "2026-09-10T14:43:17.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85981 (GCVE-0-2026-85981)

Vulnerability from nvd – Published: 2026-09-08 20:17 – Updated: 2026-09-10 14:42

Title

Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector

Summary

The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 14:42 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/unauth…

Impacted products

1 product

Vendor	Product	Version
Auth0	Auth0 AD/LDAP Connector	Affected: 0 , ≤ 6.5.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85981",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T14:42:14.078158Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T14:42:25.037Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Auth0 AD/LDAP Connector",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThanOrEqual": "6.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel\u0027s management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T20:17:06.765Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/unauthenticated-localhost-admin-panel-in-auth0-ad-ldap-connector-cve-2026-85981"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade the Auth0 AD/LDAP Connector to version 7.0.0 or greater."
        }
      ],
      "title": "Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-85981",
    "datePublished": "2026-09-08T20:17:06.765Z",
    "dateReserved": "2026-09-04T19:01:50.724Z",
    "dateUpdated": "2026-09-10T14:42:25.037Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-84685 (GCVE-0-2026-84685)

Vulnerability from nvd – Published: 2026-09-08 20:18 – Updated: 2026-09-10 14:44

Title

Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management

Summary

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory can be retrieved across subsequent requests processed by the same server runtime.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 14:44 UTC

CWE

CWE-488 - Exposure of Data Element to Wrong Session

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/improp…

Impacted products

1 product

Vendor	Product	Version
Auth0	react-native-auth0	Affected: 5.0.0 , < 5.11.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84685",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T14:44:19.402176Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T14:44:48.261Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "react-native-auth0",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "5.11.1",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The react-native-auth0 SDK\u0027s web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory can be retrieved across subsequent requests processed by the same server runtime."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-488",
              "description": "Exposure of Data Element to Wrong Session",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T20:18:48.504Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/improper-cache-isolation-in-auth0-react-native-auth0-sdk-web-platform-credential-management-cve-2026-84685"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade auth0/react-native-auth0 to version 5.11.1 or greater."
        }
      ],
      "title": "Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-84685",
    "datePublished": "2026-09-08T20:18:48.504Z",
    "dateReserved": "2026-09-01T22:41:00.184Z",
    "dateUpdated": "2026-09-10T14:44:48.261Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42280 (GCVE-0-2026-42280)

Vulnerability from nvd – Published: 2026-05-27 14:39 – Updated: 2026-05-28 15:36

Title

Improper Permission Checking in Auth.js SDK

Summary

Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-28 15:36 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7763 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/auth0/auth0.js/security/adviso…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
auth0	auth0.js	Affected: >= 8.11.0 , <= 9.32.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42280",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T15:36:47.306227Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T15:36:56.102Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "auth0.js",
          "vendor": "auth0",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.11.0 , \u003c= 9.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T14:39:15.789Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832"
        }
      ],
      "source": {
        "advisory": "GHSA-8qjv-jj2q-x832",
        "discovery": "UNKNOWN"
      },
      "title": "Improper Permission Checking in Auth.js SDK"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42280",
    "datePublished": "2026-05-27T14:39:15.789Z",
    "dateReserved": "2026-04-26T11:53:27.717Z",
    "dateUpdated": "2026-05-28T15:36:56.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40155 (GCVE-0-2026-40155)

Vulnerability from nvd – Published: 2026-04-17 20:54 – Updated: 2026-04-20 14:57

Title

Auth0 Next.js SDK has Improper Proxy Cache Lookup

Summary

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-20 14:51 UTC

CWE

CWE-863 - Incorrect Authorization
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7763 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/auth0/nextjs-auth0/security/ad…	x_refsource_CONFIRM
https://github.com/auth0/nextjs-auth0/commit/98c3…	x_refsource_MISC
https://github.com/auth0/nextjs-auth0/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
auth0	nextjs-auth0	Affected: >= 4.12.0, < 4.18.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40155",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-20T14:51:32.552302Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-20T14:57:32.023Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nextjs-auth0",
          "vendor": "auth0",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.12.0, \u003c 4.18.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-17T20:54:38.958Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-xq8m-7c5p-c2r6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-xq8m-7c5p-c2r6"
        },
        {
          "name": "https://github.com/auth0/nextjs-auth0/commit/98c36dc306970c2230ea1a32efef431d29b99978",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/auth0/nextjs-auth0/commit/98c36dc306970c2230ea1a32efef431d29b99978"
        },
        {
          "name": "https://github.com/auth0/nextjs-auth0/releases/tag/v4.18.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/auth0/nextjs-auth0/releases/tag/v4.18.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xq8m-7c5p-c2r6",
        "discovery": "UNKNOWN"
      },
      "title": "Auth0 Next.js SDK has Improper Proxy Cache Lookup"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40155",
    "datePublished": "2026-04-17T20:54:38.958Z",
    "dateReserved": "2026-04-09T19:31:56.013Z",
    "dateUpdated": "2026-04-20T14:57:32.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126129 (GCVE-0-2026-126129)

Vulnerability from cvelistv5 – Published: 2026-11-10 21:14 – Updated: 2026-11-10 21:14

Summary

The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.

Severity

No CVSS data available.

CWE

CWE-807 - Reliance on Untrusted Inputs in a Security Decision
CWE-287 - Improper Authentication
CWE-1254 - Incorrect Comparison Logic Granularity

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/improp…

Impacted products

1 product

Vendor	Product	Version
Auth0	Auth0 ASP.NET Core Authentication	Affected: 0 , < 1.12.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Auth0 ASP.NET Core Authentication",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "1.12.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session\u0027s OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-807",
              "description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1254",
              "description": "CWE-1254: Incorrect Comparison Logic Granularity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T21:14:09.582Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-126129",
    "datePublished": "2026-11-10T21:14:09.582Z",
    "dateReserved": "2026-11-10T18:52:30.790Z",
    "dateUpdated": "2026-11-10T21:14:09.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-126128 (GCVE-0-2026-126128)

Vulnerability from cvelistv5 – Published: 2026-11-10 21:09 – Updated: 2026-11-10 21:09

Summary

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.

Severity

No CVSS data available.

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-706 - Use of Incorrectly-Resolved Name or Reference

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
http://trust.okta.com/security-advisories/imprope…

Impacted products

1 product

Vendor	Product	Version
Auth0	Auth0 Node JS	Affected: 4.0.0 , < 7.6.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Auth0 Node JS",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "7.6.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token\u0027s existing scopes already permit."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-706",
              "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T21:09:20.724Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "http://trust.okta.com/security-advisories/improper-input-validation-of-path-parameters-auth0-node-js-sdk-cve-2026-126128"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-126128",
    "datePublished": "2026-11-10T21:09:20.724Z",
    "dateReserved": "2026-11-10T18:50:43.751Z",
    "dateUpdated": "2026-11-10T21:09:20.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108167 (GCVE-0-2026-108167)

Vulnerability from cvelistv5 – Published: 2026-11-10 21:07 – Updated: 2026-11-10 21:07

Summary

The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.

Severity

No CVSS data available.

CWE

CWE-863 - Incorrect Authorization

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/improp…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Auth0	auth0-ai-langchain	Affected: 0 , < 1.0.2 (python)
Auth0	auth0-ai-llamaindex	Affected: 0 , < 1.0.3 (python)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org",
          "defaultStatus": "unaffected",
          "packageName": "auth0-ai-langchain",
          "product": "auth0-ai-langchain",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "1.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        },
        {
          "collectionURL": "https://pypi.org",
          "defaultStatus": "unaffected",
          "packageName": "auth0-ai-llamaindex",
          "product": "auth0-ai-llamaindex",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "1.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T21:07:56.515Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://trust.okta.com/security-advisories/improper-access-control-in-auth0-ai-python-document-retrieval-cve-2026-108167"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-108167",
    "datePublished": "2026-11-10T21:07:56.515Z",
    "dateReserved": "2026-10-09T15:53:50.156Z",
    "dateUpdated": "2026-11-10T21:07:56.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107372 (GCVE-0-2026-107372)

Vulnerability from cvelistv5 – Published: 2026-11-10 21:05 – Updated: 2026-11-10 21:05

Summary

The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response.

Severity

No CVSS data available.

CWE

CWE-863 - Incorrect Authorization

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/improp…

Impacted products

1 product

Vendor	Product	Version
Auth0	Auth0 AI JS	Affected: 0 , < 6.0.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Auth0 AI JS",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "6.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T21:05:47.870Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/improper-access-control-in-auth0-ai-js-document-retrieval-cve-2026-107372"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-107372",
    "datePublished": "2026-11-10T21:05:47.870Z",
    "dateReserved": "2026-10-07T20:59:28.991Z",
    "dateUpdated": "2026-11-10T21:05:47.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85473 (GCVE-0-2026-85473)

Vulnerability from cvelistv5 – Published: 2026-10-13 20:08 – Updated: 2026-10-16 15:31

Title

Out-of-Range Timestamp Claim Handling in auth0/java-jwt

Summary

The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:26 UTC

CWE

CWE-755 - Improper Handling of Exceptional Conditions
CWE-20 - Improper Input Validation

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

2 references

URL	Tags
https://trust.okta.com/security-advisories/out-of…
https://github.com/auth0/java-jwt/security/adviso…

Impacted products

1 product

Vendor	Product	Version
Auth0	java-jwt	Affected: 4.0.0 , < 4.6.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85473",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:26:02.693134Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:31:55.100Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "java-jwt",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "4.6.2",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "Improper Handling of Exceptional Conditions",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T20:15:27.938Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/out-of-range-timestamp-claim-handling-in-auth0-java-jwt-cve-2026-85473"
        },
        {
          "url": "https://github.com/auth0/java-jwt/security/advisories/GHSA-cg7w-5cc2-f2xm"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade auth0/java-jwt to version 4.6.2 or greater."
        }
      ],
      "title": "Out-of-Range Timestamp Claim Handling in auth0/java-jwt"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-85473",
    "datePublished": "2026-10-13T20:08:56.332Z",
    "dateReserved": "2026-09-03T20:12:16.623Z",
    "dateUpdated": "2026-10-16T15:31:55.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107371 (GCVE-0-2026-107371)

Vulnerability from cvelistv5 – Published: 2026-10-13 20:08 – Updated: 2026-10-14 18:40

Title

Missing Verification of auth_time Claim in auth0.js

Summary

When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 18:40 UTC

CWE

CWE-613 - Insufficient Session Expiration

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

2 references

URL	Tags
https://trust.okta.com/security-advisories/missin…
https://github.com/auth0/auth0.js/security/adviso…

Impacted products

1 product

Vendor	Product	Version
Auth0	auth0.js	Affected: 9.12.0 , < 10.3.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107371",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:40:16.045683Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:40:31.506Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "auth0.js",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "10.3.0",
              "status": "affected",
              "version": "9.12.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested maximum age."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "Insufficient Session Expiration",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T20:14:25.368Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/missing-verification-of-auth_time-claim-in-auth0-js-cve-2026-107371"
        },
        {
          "url": "https://github.com/auth0/auth0.js/security/advisories/GHSA-42v6-5rcc-mq4v"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade auth0.js to version 10.3.0 or greater."
        }
      ],
      "title": "Missing Verification of auth_time Claim in auth0.js"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-107371",
    "datePublished": "2026-10-13T20:08:21.898Z",
    "dateReserved": "2026-10-07T20:59:27.478Z",
    "dateUpdated": "2026-10-14T18:40:31.506Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107370 (GCVE-0-2026-107370)

Vulnerability from cvelistv5 – Published: 2026-10-13 20:08 – Updated: 2026-10-14 18:41

Title

Improper Request Handling for Active Directory Logins in auth0-lock

Summary

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 18:40 UTC

CWE

CWE-598 - Use of GET Request Method With Sensitive Query Strings
CWE-532 - Insertion of Sensitive Information into Log File

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

2 references

URL	Tags
https://trust.okta.com/security-advisories/improp…
https://github.com/auth0/lock/security/advisories…

Impacted products

1 product

Vendor	Product	Version
Auth0	auth0-lock	Affected: 10.9.0 , < 13.2.1 (semver) Affected: 14.0.0 , < 15.0.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107370",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:40:51.235220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:41:04.775Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "auth0-lock",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "13.2.1",
              "status": "affected",
              "version": "10.9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.0.2",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "Use of GET Request Method With Sensitive Query Strings",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "Insertion of Sensitive Information into Log File",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T20:14:48.506Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/improper-request-handling-for-active-directory-logins-in-auth0-lock-cve-2026-107370"
        },
        {
          "url": "https://github.com/auth0/lock/security/advisories/GHSA-mp8m-wcxp-w648"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade auth0-lock to version 13.2.1, or version 15.0.2 or greater."
        }
      ],
      "title": "Improper Request Handling for Active Directory Logins in auth0-lock"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-107370",
    "datePublished": "2026-10-13T20:08:09.635Z",
    "dateReserved": "2026-10-07T20:59:25.866Z",
    "dateUpdated": "2026-10-14T18:41:04.775Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107369 (GCVE-0-2026-107369)

Vulnerability from cvelistv5 – Published: 2026-10-13 20:08 – Updated: 2026-10-14 18:41

Title

Improper Validation of Post-Login Redirect URL in nextjs-auth0

Summary

The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path, leading to a redirect to an unintended domain.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 18:41 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

2 references

URL	Tags
https://trust.okta.com/security-advisories/improp…
https://github.com/auth0/nextjs-auth0/security/ad…

Impacted products

1 product

Vendor	Product	Version
Auth0	nextjs-auth0	Affected: 0 , < 4.32.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T18:41:22.614149Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T18:41:32.403Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "nextjs-auth0",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "4.32.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path, leading to a redirect to an unintended domain."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T20:15:54.239Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/improper-validation-of-post-login-redirect-url-in-nextjs-auth0-cve-2026-107369"
        },
        {
          "url": "https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-5vvp-h2v6-59j6"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade auth0/nextjs-auth0 to version 4.32.0 or greater."
        }
      ],
      "title": "Improper Validation of Post-Login Redirect URL in nextjs-auth0"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-107369",
    "datePublished": "2026-10-13T20:08:00.543Z",
    "dateReserved": "2026-10-07T20:59:17.368Z",
    "dateUpdated": "2026-10-14T18:41:32.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-50157 (GCVE-0-2026-50157)

Vulnerability from cvelistv5 – Published: 2026-09-14 17:06 – Updated: 2026-09-14 20:06

Title

Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK

Summary

Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as the Authorization header for protected HTTP routes. Query-string tokens can be recorded in server logs, browser history, or referrer data and then replayed against protected API endpoints. This issue is fixed in version 5.9.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 19:20 UTC

CWE

CWE-598 - Use of GET Request Method With Sensitive Query Strings

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7763 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/auth0/symfony/security/advisor…	x_refsource_CONFIRM
https://github.com/auth0/symfony/commit/bd1851b14…	x_refsource_MISC
https://github.com/auth0/symfony/releases/tag/5.9.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
auth0	symfony	Affected: >= 5.0.0-BETA0, < 5.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50157",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T19:20:53.714296Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T20:06:21.452Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "symfony",
          "vendor": "auth0",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0-BETA0, \u003c 5.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as the Authorization header for protected HTTP routes. Query-string tokens can be recorded in server logs, browser history, or referrer data and then replayed against protected API endpoints. This issue is fixed in version 5.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-598",
              "description": "CWE-598: Use of GET Request Method With Sensitive Query Strings",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:06:23.237Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/auth0/symfony/security/advisories/GHSA-ffq7-hh2j-r24p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/auth0/symfony/security/advisories/GHSA-ffq7-hh2j-r24p"
        },
        {
          "name": "https://github.com/auth0/symfony/commit/bd1851b14ae15e99cbe87c96496cf25da025288a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/auth0/symfony/commit/bd1851b14ae15e99cbe87c96496cf25da025288a"
        },
        {
          "name": "https://github.com/auth0/symfony/releases/tag/5.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/auth0/symfony/releases/tag/5.9.0"
        }
      ],
      "source": {
        "advisory": "GHSA-ffq7-hh2j-r24p",
        "discovery": "UNKNOWN"
      },
      "title": "Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50157",
    "datePublished": "2026-09-14T17:06:23.237Z",
    "dateReserved": "2026-06-03T20:54:20.432Z",
    "dateUpdated": "2026-09-14T20:06:21.452Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-84685 (GCVE-0-2026-84685)

Vulnerability from cvelistv5 – Published: 2026-09-08 20:18 – Updated: 2026-09-10 14:44

Title

Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management

Summary

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory can be retrieved across subsequent requests processed by the same server runtime.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 14:44 UTC

CWE

CWE-488 - Exposure of Data Element to Wrong Session

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/improp…

Impacted products

1 product

Vendor	Product	Version
Auth0	react-native-auth0	Affected: 5.0.0 , < 5.11.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84685",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T14:44:19.402176Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T14:44:48.261Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "react-native-auth0",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThan": "5.11.1",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The react-native-auth0 SDK\u0027s web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory can be retrieved across subsequent requests processed by the same server runtime."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-488",
              "description": "Exposure of Data Element to Wrong Session",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T20:18:48.504Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/improper-cache-isolation-in-auth0-react-native-auth0-sdk-web-platform-credential-management-cve-2026-84685"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade auth0/react-native-auth0 to version 5.11.1 or greater."
        }
      ],
      "title": "Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-84685",
    "datePublished": "2026-09-08T20:18:48.504Z",
    "dateReserved": "2026-09-01T22:41:00.184Z",
    "dateUpdated": "2026-09-10T14:44:48.261Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85983 (GCVE-0-2026-85983)

Vulnerability from cvelistv5 – Published: 2026-09-08 20:18 – Updated: 2026-09-10 14:43

Title

Local Privilege Escalation in Auth0 AD/LDAP Connector

Summary

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 14:43 UTC

CWE

CWE-94 - Improper Control of Generation of Code

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/local-…

Impacted products

1 product

Vendor	Product	Version
Auth0	Auth0 AD/LDAP Connector	Affected: 0 , ≤ 6.5.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85983",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T14:43:45.813987Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T14:43:59.925Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Auth0 AD/LDAP Connector",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThanOrEqual": "6.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector\u0027s configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Improper Control of Generation of Code",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T20:18:09.381Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/local-privilege-escalation-in-auth0-ad-ldap-connector-cve-2026-85983"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade the auth0/ad-ldap-connector to version 7.00 or greater."
        }
      ],
      "title": "Local Privilege Escalation in Auth0 AD/LDAP Connector"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-85983",
    "datePublished": "2026-09-08T20:18:09.381Z",
    "dateReserved": "2026-09-04T19:04:28.553Z",
    "dateUpdated": "2026-09-10T14:43:59.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85982 (GCVE-0-2026-85982)

Vulnerability from cvelistv5 – Published: 2026-09-08 20:17 – Updated: 2026-09-10 14:43

Title

Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector

Summary

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs.

Severity

9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 14:43 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/stored…

Impacted products

1 product

Vendor	Product	Version
Auth0	Auth0 AD/LDAP Connector	Affected: 0 , ≤ 6.5.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85982",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T14:43:01.622324Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T14:43:17.196Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Auth0 AD/LDAP Connector",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThanOrEqual": "6.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator\u0027s browser when they view the affected search results or update logs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T20:17:40.063Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/stored-cross-site-scripting-xss-in-auth0-ad-ldap-connector-cve-2026-85982"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade the Auth0 AD/LDAP Connector to version 7.0.0 or greater."
        }
      ],
      "title": "Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-85982",
    "datePublished": "2026-09-08T20:17:40.063Z",
    "dateReserved": "2026-09-04T19:03:24.108Z",
    "dateUpdated": "2026-09-10T14:43:17.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85981 (GCVE-0-2026-85981)

Vulnerability from cvelistv5 – Published: 2026-09-08 20:17 – Updated: 2026-09-10 14:42

Title

Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector

Summary

The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 14:42 UTC

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

Okta CNA under the mitre root

CNA scorecard C 67/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://trust.okta.com/security-advisories/unauth…

Impacted products

1 product

Vendor	Product	Version
Auth0	Auth0 AD/LDAP Connector	Affected: 0 , ≤ 6.5.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85981",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T14:42:14.078158Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T14:42:25.037Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Auth0 AD/LDAP Connector",
          "vendor": "Auth0",
          "versions": [
            {
              "lessThanOrEqual": "6.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel\u0027s management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "Missing Authentication for Critical Function",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T20:17:06.765Z",
        "orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
        "shortName": "Okta"
      },
      "references": [
        {
          "url": "https://trust.okta.com/security-advisories/unauthenticated-localhost-admin-panel-in-auth0-ad-ldap-connector-cve-2026-85981"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade the Auth0 AD/LDAP Connector to version 7.0.0 or greater."
        }
      ],
      "title": "Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
    "assignerShortName": "Okta",
    "cveId": "CVE-2026-85981",
    "datePublished": "2026-09-08T20:17:06.765Z",
    "dateReserved": "2026-09-04T19:01:50.724Z",
    "dateUpdated": "2026-09-10T14:42:25.037Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42280 (GCVE-0-2026-42280)

Vulnerability from cvelistv5 – Published: 2026-05-27 14:39 – Updated: 2026-05-28 15:36

Title

Improper Permission Checking in Auth.js SDK

Summary

Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-28 15:36 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7763 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/auth0/auth0.js/security/adviso…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
auth0	auth0.js	Affected: >= 8.11.0 , <= 9.32.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42280",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T15:36:47.306227Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T15:36:56.102Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "auth0.js",
          "vendor": "auth0",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.11.0 , \u003c= 9.32.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T14:39:15.789Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832"
        }
      ],
      "source": {
        "advisory": "GHSA-8qjv-jj2q-x832",
        "discovery": "UNKNOWN"
      },
      "title": "Improper Permission Checking in Auth.js SDK"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42280",
    "datePublished": "2026-05-27T14:39:15.789Z",
    "dateReserved": "2026-04-26T11:53:27.717Z",
    "dateUpdated": "2026-05-28T15:36:56.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40155 (GCVE-0-2026-40155)

Vulnerability from cvelistv5 – Published: 2026-04-17 20:54 – Updated: 2026-04-20 14:57

Title

Auth0 Next.js SDK has Improper Proxy Cache Lookup

Summary

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-20 14:51 UTC

CWE

CWE-863 - Incorrect Authorization
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7763 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/auth0/nextjs-auth0/security/ad…	x_refsource_CONFIRM
https://github.com/auth0/nextjs-auth0/commit/98c3…	x_refsource_MISC
https://github.com/auth0/nextjs-auth0/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
auth0	nextjs-auth0	Affected: >= 4.12.0, < 4.18.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40155",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-20T14:51:32.552302Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-20T14:57:32.023Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nextjs-auth0",
          "vendor": "auth0",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.12.0, \u003c 4.18.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-17T20:54:38.958Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-xq8m-7c5p-c2r6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-xq8m-7c5p-c2r6"
        },
        {
          "name": "https://github.com/auth0/nextjs-auth0/commit/98c36dc306970c2230ea1a32efef431d29b99978",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/auth0/nextjs-auth0/commit/98c36dc306970c2230ea1a32efef431d29b99978"
        },
        {
          "name": "https://github.com/auth0/nextjs-auth0/releases/tag/v4.18.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/auth0/nextjs-auth0/releases/tag/v4.18.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xq8m-7c5p-c2r6",
        "discovery": "UNKNOWN"
      },
      "title": "Auth0 Next.js SDK has Improper Proxy Cache Lookup"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40155",
    "datePublished": "2026-04-17T20:54:38.958Z",
    "dateReserved": "2026-04-09T19:31:56.013Z",
    "dateUpdated": "2026-04-20T14:57:32.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

124 vulnerabilities by Auth0

CVE-2026-126129 (GCVE-0-2026-126129)

CVE-2026-126128 (GCVE-0-2026-126128)

CVE-2026-108167 (GCVE-0-2026-108167)

CVE-2026-107372 (GCVE-0-2026-107372)

CVE-2026-85473 (GCVE-0-2026-85473)

CVE-2026-107371 (GCVE-0-2026-107371)

CVE-2026-107370 (GCVE-0-2026-107370)

CVE-2026-107369 (GCVE-0-2026-107369)

CVE-2026-50157 (GCVE-0-2026-50157)

CVE-2026-85983 (GCVE-0-2026-85983)

CVE-2026-85982 (GCVE-0-2026-85982)

CVE-2026-85981 (GCVE-0-2026-85981)

CVE-2026-84685 (GCVE-0-2026-84685)

CVE-2026-42280 (GCVE-0-2026-42280)

CVE-2026-40155 (GCVE-0-2026-40155)

CVE-2026-126129 (GCVE-0-2026-126129)

CVE-2026-126128 (GCVE-0-2026-126128)

CVE-2026-108167 (GCVE-0-2026-108167)

CVE-2026-107372 (GCVE-0-2026-107372)

CVE-2026-85473 (GCVE-0-2026-85473)

CVE-2026-107371 (GCVE-0-2026-107371)

CVE-2026-107370 (GCVE-0-2026-107370)

CVE-2026-107369 (GCVE-0-2026-107369)

CVE-2026-50157 (GCVE-0-2026-50157)

CVE-2026-84685 (GCVE-0-2026-84685)

CVE-2026-85983 (GCVE-0-2026-85983)

CVE-2026-85982 (GCVE-0-2026-85982)

CVE-2026-85981 (GCVE-0-2026-85981)

CVE-2026-42280 (GCVE-0-2026-42280)

CVE-2026-40155 (GCVE-0-2026-40155)