auth0

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digit…

Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs.

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs.

An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress.

The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature.

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs.

In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced.

An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress.

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel.

omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method.

passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol.

Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport.

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect.

ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidential data loss.

Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.

An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin.

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.

CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.

auth0/node-jws is a JSON Web Signature implementation for Node.js.

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications.

auth0-lock is Auth0's signin solution.

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5.

passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol.

In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used.