Read the docs

auth0

Records58All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical11CVSS 9.0–10.0
CVSS high24CVSS 7.0–8.9

Exploited now

auth0 records in CISA KEV

No auth0 vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Auth0.js 7 records MEDIUM Nextjs-auth0 5 records LOW Jsonwebtoken 4 records MEDIUM Lock 4 records LOW Login By Auth0 4 records MEDIUM Wp-auth0 3 records MEDIUM Auth0-php 2 records MEDIUM Express Openid Connect 2 records MEDIUM

Records

4 records in Lock · all components

TI-2021-12309 CVE-2021-32641 · GHSA-jr3j-whm4-9wwm

Reflected XSS when using flashMessages

Priority LOW 38

auth0-lock is Auth0's signin solution.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01539 Published 2021-06-04 Fixed in 11.30.1 CWE-79
TI-2020-11893 CVE-2020-15119 · GHSA-6gg3-pmm7-97xc

DOM-based XSS in auth0-lock

Priority LOW 29

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM.

CVSS 3.1MEDIUM 6.4 Network Low privileges User interaction EPSS 0.00546 Published 2020-08-19 Fixed in 11.26.3 CWE-79
TI-2022-11716 CVE-2022-29172 · GHSA-7ww6-75fj-jcj7

HTML injection with additional signup fields

Priority LOW 28

Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00622 Published 2022-05-05 Fixed in 11.33.0 CWE-79
Open these records in search →