TI-2021-12309 Aliases CVE-2021-32641 GHSA-jr3j-whm4-9wwm

Reflected XSS when using flashMessages

LOW 38CWE-79Published 2021-06-04 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage` or the library's `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`. The vulnerability is patched in version 11.30.1.

Why it matters now

EPSS 0.01539 75th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed auth0-lock (npm): 11.30.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
auth0	lock	up to 11.30.0	—	No fix listed	CNA
—	auth0-lock (npm)	before 11.30.1	11.30.1	Patch available	GHSA-jr3j-whm4-9wwm

lock Vendorauth0 Affected up to 11.30.0 Fixed in — No fix listed CNA
auth0-lock (npm) Vendor— Affected before 11.30.1 Fixed in 11.30.1 Patch available GHSA-jr3j-whm4-9wwm

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:auth0:lock::::::::	before 11.30.1	Vulnerable	auth0

cpe:2.3:a:auth0:lock:*:*:*:*:*:*:*:* Versions before 11.30.1 Vulnerable ·auth0

Remediation

Fix · GHSA-jr3j-whm4-9wwm auth0-lock (npm) Fixed in 11.30.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-32641
2026-10-03 Alias added: GHSA-jr3j-whm4-9wwm

References

Exploit 1

https://github.com/auth0/lock/security/advisories/GHSA-jr3j-whm4-9wwm

Patch 1

https://github.com/auth0/lock/commit/d139cf01c8234b07caf265e051f39d3eab08f7ed

Advisory 2

TI-2020-11893 DOM-based XSS in auth0-lock CVSS 3.1MEDIUM 6.4
TI-2022-11716 HTML injection with additional signup fields CVSS 3.1MEDIUM 6.1
TI-2019-14549 Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder. CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences