Read the docs
TI-2022-11716 Aliases CVE-2022-29172GHSA-7ww6-75fj-jcj7

HTML injection with additional signup fields

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before `11.33.0`, when the “additional signup fields” feature [is configured](https://github.com/auth0/lock#additional-sign-up-fields), a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service `user_metdata` payload (using the `name` property). Verification emails, when applicable, are generated using this metadata. It is therefor possible for an actor to craft a malicious link by injecting HTML, which is then rendered as the recipient's name within the delivered email template. You are impacted by this vulnerability if you are using `auth0-lock` version `11.32.2` or lower and are using the “additional signup fields” feature in your application. Upgrade to version `11.33.0`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00622 50th percentileScored 2026-11-07
Fix Fixed lock (auth0): 11.33.0auth0-lock (npm): 11.33.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
auth0lockbefore 11.33.011.33.0Patch availableCNA
—auth0-lock (npm)before 11.33.011.33.0Patch availableGHSA-7ww6-75fj-jcj7
  • lock Vendorauth0 Affected before 11.33.0 Fixed in 11.33.0 Patch available CNA
  • auth0-lock (npm) Vendor— Affected before 11.33.0 Fixed in 11.33.0 Patch available GHSA-7ww6-75fj-jcj7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:auth0:lock:*:*:*:*:*:node.js:*:*before 11.33.0Vulnerableauth0
  • cpe:2.3:a:auth0:lock:*:*:*:*:*:node.js:*:* Versions before 11.33.0 Vulnerable ·auth0

Remediation

  • Fix · CNA lock (auth0) Fixed in 11.33.0
  • Fix · GHSA-7ww6-75fj-jcj7 auth0-lock (npm) Fixed in 11.33.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-29172
  2. 2026-10-03 Alias added: GHSA-7ww6-75fj-jcj7
  3. 2026-11-06 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 1

  • TI-2021-12309 Reflected XSS when using flashMessages CVSS 3.1HIGH 8.1
  • TI-2020-11893 DOM-based XSS in auth0-lock CVSS 3.1MEDIUM 6.4
  • TI-2019-14549 Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder. CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences