auth0 vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-85983 The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup.High 7.8 · Sep 8, 2026
• CVE-2026-85982 The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log coCritical 9 · Sep 8, 2026
• CVE-2026-42280 Auth0.js is a client-side JavaScript library for Auth0.High 7.1 · May 27, 2026
• CVE-2026-34236 Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs.High 8.2 · Apr 1, 2026
• CVE-2025-65945 auth0/node-jws is a JSON Web Signature implementation for Node.js.High 7.5 · Dec 4, 2025
• CVE-2025-48947 The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications.High 7.7 · Jun 4, 2025
• CVE-2025-46573 passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol.High 8.6 · May 6, 2025
• CVE-2025-46572 passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol.Critical 9.3 · May 6, 2025
• CVE-2022-24794 Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect.High 7.5 · Mar 31, 2022
• CVE-2021-32702 The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications.High 8 · Jun 25, 2021
• CVE-2021-32641 auth0-lock is Auth0's signin solution.High 8.1 · Jun 4, 2021
• CVE-2020-15259 ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidentialHigh 8.1 · Nov 6, 2020
• CVE-2020-15240 omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method.High 7.4 · Oct 21, 2020
• CVE-2020-15125 In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is useHigh 7.7 · Jul 29, 2020
• CVE-2020-15084 In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced.High 7.7 · Jun 30, 2020
• CVE-2019-16929 Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens.High 7.5 · Oct 8, 2019
• CVE-2019-13483 Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing.High 7.3 · Jul 25, 2019
• CVE-2019-7644 Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature.Critical 9.8 · Apr 11, 2019
• CVE-2018-15121 An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin.High 8.8 · Aug 28, 2018
• CVE-2018-6874 CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.High 8.8 · Apr 4, 2018
• CVE-2018-6873 The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.Critical 9.8 · Apr 4, 2018
• CVE-2018-7307 The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.High 8.8 · Mar 6, 2018
• CVE-2017-16897 A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5.High 8.1 · Dec 27, 2017
• CVE-2017-17068 A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12.High 7.5 · Dec 6, 2017