Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

58 records

Vendor: auth0 Clear all filters
TI-2026-73627 CVE-2026-107371

Missing auth_time validation in Auth0 auth0.js

Priority LOW 24

When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00209 Published 2026-10-13 Fixed in 10.3.0 CWE-613
TI-2026-73626 CVE-2026-107370

Active Directory login data exposed in auth0-lock query strings

Priority LOW 24

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00281 Published 2026-10-13 Fixed in 13.2.1, 15.0.2 CWE-532
TI-2026-73625 CVE-2026-107369

Open redirect in Auth0 nextjs-auth0 after login

Priority LOW 27

The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00225 Published 2026-10-13 Fixed in 4.32.0 CWE-601
TI-2026-58857 CVE-2026-85983 · GHSA-pvm6-cj89-m3wx

Local Privilege Escalation in Auth0 AD/LDAP Connector

Priority LOW 35

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00201 Published 2026-09-08 No fix listed CWE-94
TI-2026-58856 CVE-2026-85982

Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector

Priority MEDIUM 41

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00401 Published 2026-09-08 No fix listed CWE-79
TI-2026-58855 CVE-2026-85981

Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector

Priority LOW 31

The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00185 Published 2026-09-08 No fix listed CWE-306
TI-2026-30591 CVE-2026-42280 · GHSA-8qjv-jj2q-x832

Improper Permission Checking in Auth.js SDK

Priority LOW 31

Auth0.js is a client-side JavaScript library for Auth0.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00211 Published 2026-05-27 Fixed in 10.0.0 CWE-863
TI-2026-28970 CVE-2026-40155 · GHSA-xq8m-7c5p-c2r6

Auth0 Next.js SDK has Improper Proxy Cache Lookup

Priority LOW 24

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00214 Published 2026-04-17 Fixed in 4.18.0 CWE-362
TI-2025-41710 CVE-2025-68129 · GHSA-j2vm-wrq3-f7gf

Auth0-PHP SDK has Improper Audience Validation

Priority LOW 35

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00425 Published 2025-12-17 Fixed in 8.18.0 CWE-863
TI-2025-41249 CVE-2025-67490 · GHSA-wcgj-f865-c7j7

Auth0 Next.js SDK has Improper Request Caching Lookup

Priority LOW 24

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00202 Published 2025-12-10 Fixed in 4.12.1, 4.11.2 CWE-863
TI-2025-29085 CVE-2025-46344 · GHSA-pjr6-jx7r-j4r6

Auth0 NextJS SDK v4 Missing Session Invalidation

Priority LOW 23

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications.

CVSS 4.0MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00438 Published 2025-04-29 Fixed in 4.5.1 CWE-613
TI-2023-06225 CVE-2023-6813 · GHSA-x6p7-44rh-m3rr

Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle

Priority LOW 27

The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00359 Published 2024-07-10 Fixed in 4.6.1 CWE-79
TI-2022-07594 CVE-2022-23539 · GHSA-8cf7-32gw-wr33

jsonwebtoken unrestricted key type could lead to legacy keys usage

Priority LOW 36

Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00524 Published 2022-12-22 Partial fix · 9.0.0 CWE-327
Load more