Auth0 vulnerabilities

Products

• Auth0.js 8
• Nextjs-auth0 8
• Auth0-php 4
• Jsonwebtoken 4
• Lock 4
• Login By Auth0 4
• Passport-wsfed-saml2 4
• Ad/ldap Connector 3
• Node-jsonwebtoken 3
• Wp-auth0 3
• Express-openid-connect 2
• Express Openid Connect 2
• Laravel-auth0 2
• Symfony 2

Newest

• auth0 java-jwt Out-of-Range Timestamp Claim Handling in auth0/java-jwt CVE-2026-85473 5.3 MediumOctober 13, 2026
• auth0 auth0.js Missing Verification of auth_time Claim in auth0.js CVE-2026-107371 5.4 MediumOctober 13, 2026
• auth0 auth0-lock Improper Request Handling for Active Directory Logins in auth0-lock CVE-2026-107370 5.3 MediumOctober 13, 2026
• auth0 nextjs-auth0 Improper Validation of Post-Login Redirect URL in nextjs-auth0 CVE-2026-107369 6.1 MediumOctober 13, 2026
• auth0 react-native-auth0 Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management CVE-2026-84685 6.5 MediumSeptember 8, 2026
• auth0 ad/ldap connector Local Privilege Escalation in Auth0 AD/LDAP Connector CVE-2026-85983 7.8 HighSeptember 8, 2026
• auth0 ad/ldap connector Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector CVE-2026-85982 9.0 CriticalSeptember 8, 2026
• auth0 ad/ldap connector Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector CVE-2026-85981 6.7 MediumSeptember 8, 2026
• auth0 symfony Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK CVE-2026-50157 Fix available 6.5 MediumJuly 14, 2026
• auth0 auth0.js Improper Permission Checking in Auth.js SDK CVE-2026-42280 Fix available 7.1 HighMay 6, 2026
• auth0 nextjs-auth0 Auth0 Next.js SDK has Improper Proxy Cache Lookup CVE-2026-40155 Fix available 5.4 MediumApril 17, 2026
• auth0 auth0-php Auth0 PHP SDK Insufficient Entropy in Cookie Encryption CVE-2026-34236 Fix available 8.2 HighApril 1, 2026
• auth0 auth0-php, laravel-auth0, symfony +1 more +3 more Auth0-PHP SDK has Improper Audience Validation CVE-2025-68129 Fix available 6.8 MediumDecember 17, 2025
• auth0 nextjs-auth0 Auth0 Next.js SDK has Improper Validation of Query Parameters CVE-2025-67716 Fix available 5.7 MediumDecember 10, 2025
• auth0 nextjs-auth0 Auth0 Next.js SDK has Improper Request Caching Lookup CVE-2025-67490 Fix available 5.4 MediumDecember 10, 2025
• auth0 node-jws auth0/node-jws improper HMAC signature verification vulnerability CVE-2025-65945 Public exploitFix available 7.5 HighDecember 4, 2025
• auth0 laravel-auth0 auth0-PHP: Improper File Type Handling in Bulk User Import CVE-2025-58769 Fix available 3.3 LowOctober 1, 2025
• auth0 nextjs-auth0 NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies CVE-2025-48947 Fix available 7.7 HighJune 4, 2025
• auth0 auth0-php Auth0-PHP SDK Deserialization of Untrusted Data vulnerability CVE-2025-48951 Fix available 9.3 CriticalJune 3, 2025
• auth0 auth0-php Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVE-2025-47275 Fix available 9.1 CriticalMay 15, 2025
• auth0 passport-wsfed-saml2 passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smuggling CVE-2025-46573 Fix available 8.6 HighMay 6, 2025
• auth0 passport-wsfed-saml2 passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrapping CVE-2025-46572 Fix available 9.3 CriticalMay 6, 2025
• auth0 nextjs-auth0 Auth0 NextJS SDK v4 Missing Session Invalidation CVE-2025-46344 Fix available 4.9 MediumApril 29, 2025
• auth0 login by auth0 Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle CVE-2023-6813 Fix available 6.1 MediumJuly 10, 2024
• auth0 jsonwebtoken, node-jsonwebtoken +1 more jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC CVE-2022-23541 Fix available 5.0 MediumDecember 22, 2022
• auth0 jsonwebtoken, node-jsonwebtoken +1 more jsonwebtoken unrestricted key type could lead to legacy keys usage CVE-2022-23539 Fix available 5.9 MediumDecember 22, 2022
• auth0 passport-wsfed-saml2 Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication CVE-2022-23505 Fix available 5.3 MediumDecember 13, 2022
• auth0 lock HTML injection with additional signup fields CVE-2022-29172 Fix available 6.1 MediumMay 5, 2022
• auth0 express-openid-connect, express openid connect +1 more Open Redirect in express-openid-connect CVE-2022-24794 Fix available 7.5 HighMarch 31, 2022
• auth0 nextjs-auth0 Open redirect in nextjs-auth0 CVE-2021-43812 Fix available 6.4 MediumDecember 16, 2021
• auth0 express-openid-connect, express openid connect +1 more Session fixation in express-openid-connect CVE-2021-41246 Fix available 4.6 MediumDecember 9, 2021
• auth0 nextjs-auth0 Reflected XSS from the callback handler's error query parameter CVE-2021-32702 Fix available 8.0 HighJune 25, 2021
• auth0 lock Reflected XSS when using flashMessages CVE-2021-32641 Fix available 8.1 HighJune 4, 2021
• auth0 ad-ldap-connector, ad\/ldap connector +1 more CSRF in Auth0 ad-ldap-connector CVE-2020-15259 8.1 HighNovember 6, 2020
• auth0 omniauth-auth0 Regression in JWT Signature Validation CVE-2020-15240 Fix available 7.4 HighOctober 21, 2020
• auth0 jsonwebtoken, node-jsonwebtoken +1 more jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() CVE-2022-23540 Fix available 6.4 MediumSeptember 2, 2020
• auth0 lock DOM-based XSS in auth0-lock CVE-2020-15119 Fix available 6.4 MediumAugust 19, 2020
• auth0 auth0.js, node-auth0 +1 more Authorization header is not sanitized in an error object in auth0 CVE-2020-15125 Fix available 7.7 HighJuly 29, 2020
• auth0 express-jwt Authorization bypass in express-jwt CVE-2020-15084 Fix available 7.7 HighJune 30, 2020
• auth0 auth0.js Information disclosure through error object CVE-2020-5263 Fix available 5.5 MediumApril 9, 2020
• auth0 login by auth0 An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can... CVE-2020-7948 8.8 HighApril 1, 2020
• auth0 login by auth0 An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous... CVE-2020-7947 9.8 CriticalApril 1, 2020
• auth0 wp-auth0 Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for... CVE-2020-5391 8.8 HighApril 1, 2020
• auth0 login by auth0 The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a... CVE-2020-6753 6.1 MediumApril 1, 2020
• auth0 wp-auth0 A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for... CVE-2020-5392 6.1 MediumApril 1, 2020
• auth0 login by auth0 The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php. CVE-2019-20173 6.1 MediumFebruary 5, 2020
• auth0 lock auth0-lock vulnerable to XSS via unsanitized placeholder property CVE-2019-20174 Fix available 6.1 MediumJanuary 31, 2020
• auth0 auth0.net Improper Authentication in Auth0.AuthenticationApi CVE-2019-16929 Fix available 7.5 HighOctober 8, 2019
• auth0 passport-sharepoint Auth0 Passport-SharePoint does not validate JWT signature CVE-2019-13483 Fix available 7.3 HighJuly 25, 2019
• auth0 auth0-wcf-service-jwt Critical severity vulnerability that affects Auth0-WCF-Service-JWT CVE-2019-7644 Fix available 9.8 CriticalApril 11, 2019
• Show olderLoading…