Auth0
Vulnerability activity for Auth0: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 9
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 15
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.3MediumOct 13, 2026Auth0 java-jwt Crypto / certificateCVE-2026-85473The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affect
- 5.4MediumOct 13, 2026auth0.jsCVE-2026-107371When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested
- 5.3MediumOct 13, 2026auth0-lockCVE-2026-107370When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.
- 6.1MediumOct 13, 2026nextjs-auth0CVE-2026-107369The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative path,
- 6.5MediumSep 14, 2026Auth0 symfonyCVE-2026-50157Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as
- 6.5MediumSep 8, 2026react-native-auth0CVE-2026-84685The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory c
- 7.8HighSep 8, 2026Auth0 AD/LDAP Connector Code / command injectionCVE-2026-85983The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the ser
- 9.0CriticalSep 8, 2026Auth0 AD/LDAP Connector XSSCVE-2026-85982The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on
- 6.7MediumSep 8, 2026Auth0 AD/LDAP Connector Auth bypass / access controlCVE-2026-85981The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throug
- 7.1HighMay 27, 2026auth0.js Auth bypass / access controlCVE-2026-42280Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.
- 5.4MediumApr 17, 2026nextjs-auth0 Auth bypass / access controlCVE-2026-40155The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if thei
- 8.2HighApr 1, 2026auth0-PHPCVE-2026-34236Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cook
- 5.7MediumDec 11, 2025nextjs-auth0CVE-2025-67716The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Suc
- 5.4MediumDec 10, 2025nextjs-auth0 Auth bypass / access controlCVE-2025-67490The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in vers
- 7.5HighDec 4, 2025Auth0 node-jws Crypto / certificateCVE-2025-65945auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVeri
- 3.3LowOct 1, 2025laravel-auth0 Path traversal / file handlingCVE-2025-58769auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with the SDK does not validate the file-path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or U
- 7.7HighJun 4, 2025nextjs-auth0CVE-2025-48947The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session` cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for som
- 9.3CriticalJun 3, 2025auth0-PHP DeserializationCVE-2025-48951Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted
- 9.1CriticalMay 15, 2025auth0-PHP Auth bypass / access controlCVE-2025-47275Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unautho
- 8.6HighMay 6, 2025Auth0 passport-wsfed-saml2 Auth bypass / access controlCVE-2025-46573passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done by a
- 9.3CriticalMay 6, 2025Auth0 passport-wsfed-saml2 Auth bypass / access controlCVE-2025-46572passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a valid
Top products
- nextjs-auth04 CVEs in the last year
- Auth0 AD/LDAP Connector3 CVEs in the last year, 1 critical
- auth0.js2 CVEs in the last year
- symfony1 CVE in the last year
- react-native-auth01 CVE in the last year
- node-jws1 CVE in the last year
- java-jwt1 CVE in the last year
- auth0-PHP1 CVE in the last year
- auth0-lock1 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- Okta · Oct 13, 2026Missing Verification of auth_time Claim in auth0.js CVE-2026-107371 - Oct 13, 2026CVE-2026-107371
- Okta · Oct 13, 2026Out-of-Range Timestamp Claim Handling in auth0/java-jwt CVE-2026-85473 - Oct 13, 2026CVE-2026-85473
- Okta · Oct 13, 2026Improper Validation of Post-Login Redirect URL in nextjs-auth0 CVE-2026-107369 - Oct 13, 2026CVE-2026-107369
- Okta · Oct 13, 2026Improper Request Handling for Active Directory Logins in auth0-lock CVE-2026-107370 - Oct 13, 2026CVE-2026-107370
- Okta · Sep 8, 2026Local Privilege Escalation in Auth0 AD/LDAP Connector CVE-2026-85983 - Sep 8, 2026CVE-2026-85983
- Okta · Sep 8, 2026Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector CVE-2026-85981 - Sep 8, 2026CVE-2026-85981
- Okta · Sep 8, 2026Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector CVE-2026-85982 - Sep 8, 2026CVE-2026-85982
- Okta · Sep 8, 2026Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management CVE-2026-84685 - Sep 8, 2026CVE-2026-84685
- Okta · Jun 10, 2026Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK CVE-2026-50157 - Jun 10, 2026CVE-2026-50157
- Okta · May 6, 2026Improper Permission Checking in Auth0.js SDK CVE-2026-42280 - May 6, 2026CVE-2026-42280
- Okta · Apr 17, 2026Improper Proxy Cache Lookup in the Auth0 Next.js SDK CVE-2026-40155 - Apr 17, 2026CVE-2026-40155
- Okta · Apr 1, 2026Insufficient Entropy in Cookie Encryption in Auth0 Symfony SDK CVE-2026-34236 - Apr 1, 2026CVE-2026-34236
- Okta · Apr 1, 2026Auth0 PHP SDK Insufficient Entropy in Cookie Encryption CVE-2026-34236 - Apr 1, 2026CVE-2026-34236
- Okta · Apr 1, 2026Insufficient Entropy in Cookie Encryption in Auth0 WordPress Plugin CVE-2026-34236 - Apr 1, 2026CVE-2026-34236
- Okta · Apr 1, 2026Insufficient Entropy in Cookie Encryption in Auth0 laravel-auth0 SDK CVE-2026-34236 - Apr 1, 2026CVE-2026-34236
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.