CVE-2018-15121
Auth0-ASPNET and Auth0-ASPNET-Owin vulnerable to Cross-Site Request Forgery
CVE-2018-15121 is a high vulnerability (CVSS 8.8) in Auth0 Aspnet, published August 29, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. No source names a fixed version.
- Severity
- 8.8 HighCVSS 3.0, NVD
- Exploit chance
- 0.49%EPSS, 42nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Auth0-ASPNET-OwinNuGet | through 2.3.2 | None known |
auth0-aspnetNuGet | through 2.1.1 | None known |
Auth0-ASPNET-OwinNuGet | through 2.3.2, plus listed versions 0.4.10.4.20.4.30.4.40.4.5 Show 22 moreShow less0.4.60.4.70.5.00.6.00.6.10.6.21.0.01.0.11.0.21.0.31.0.41.1.01.1.12.0.02.0.0-beta12.0.0-beta22.1.02.2.02.2.12.2.22.3.02.3.1 | None known |
auth0-aspnetNuGet | through 2.1.1, plus listed versions 0.9.20.9.30.9.40.9.50.9.7 Show 15 moreShow less1.0.01.1.01.2.01.2.11.3.01.3.11.3.21.4.01.5.01.5.0-beta11.5.0-beta21.5.0-beta31.6.02.0.02.1.0 | None known |
What each source reports
NVD Score used
An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.
- Record
CVE-2018-15121- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE ListNo score
An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.
- Record
CVE-2018-15121- Updated
- 2026-11-02
EUVDEUVD-2022-4591No score
An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.
- Record
EUVD-2022-4591- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mmhr-3jr7-qj2p
Auth0-ASPNET and Auth0-ASPNET-Owin vulnerable to Cross-Site Request Forgery
An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.
- Record
GHSA-mmhr-3jr7-qj2p- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-mmhr-3jr7-qj2p
Auth0-ASPNET and Auth0-ASPNET-Owin vulnerable to Cross-Site Request Forgery
An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.
- Record
GHSA-mmhr-3jr7-qj2p- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.