Read the docs
TI-2026-73626 Aliases CVE-2026-107370

Active Directory login data exposed in auth0-lock query strings

Priority LOW 24CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

The auth0-lock library, a login widget from Auth0, sends the authentication request for Active Directory connections with a GET instead of a POST when the username is a domain without a local part. Submitted form data is therefore appended to the URL as query string parameters, exposing sensitive information (CWE-598). A remote attacker can read that data from URLs in logs or browser history if the user interacts with the login form, though the attack is of high complexity. The affected versions are from 10.9.0 before 13.2.1 and from 14.0.0 before 15.0.2.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00281 20th percentileScored 2026-11-07
Fix Fixed auth0-lock (Auth0): 13.2.1, 15.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
auth0auth0-lock10.9.0 to before 13.2.1; 14.0.0 to before 15.0.213.2.1, 15.0.2Patch availableCNA
  • auth0-lock Vendorauth0 Affected 10.9.0 to before 13.2.1; 14.0.0 to before 15.0.2 Fixed in 13.2.1, 15.0.2 Patch available CNA

Remediation

Upgrade auth0-lock to version 13.2.1 for the 13.x line or to version 15.0.2 for the 15.x line. No fixed version is listed for auth0-lock 14.x, which falls in the affected range 14.0.0 before 15.0.2.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA auth0-lock (Auth0) Fixed in 13.2.1, 15.0.2

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-107370
  2. 2026-10-15 CISA SSVC decision points changed

References

Other 2

  • TI-2015-07615 Improper input validation in HackerOne jsonwebtoken node module CVSS 3.0CRITICAL 9.8
  • TI-2025-29805 Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVSS 3.1CRITICAL 9.1
  • TI-2025-31089 Auth0-PHP SDK Deserialization of Untrusted Data vulnerability CVSS 4.0CRITICAL 9.3
  • TI-2020-06427 An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. CVSS 3.1CRITICAL 9.8
  • TI-2018-05020 The Auth0 authentication service before 2017-10-15 allows privilege escalation because… CVSS 3.0CRITICAL 9.8
  • TI-2019-05387 Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error… CVSS 3.0CRITICAL 9.8
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences