Auth0 vulnerabilities
44 CVEs and advisories name Auth0 as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-126129The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a…
- CVE-2026-126128The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management…
- CVE-2026-108167The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when…
- CVE-2026-107372The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during…
- CVE-2026-85473Out-of-Range Timestamp Claim Handling in auth0/java-jwt
- CVE-2026-107371Missing Verification of auth_time Claim in auth0.js
- CVE-2026-107370Improper Request Handling for Active Directory Logins in auth0-lock
- CVE-2026-107369Improper Validation of Post-Login Redirect URL in nextjs-auth0
- CVE-2026-50157Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK
- CVE-2026-84685Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management
- CVE-2026-85983Local Privilege Escalation in Auth0 AD/LDAP Connector
- CVE-2026-85982Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
- CVE-2026-85981Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector
- CVE-2026-42280Improper Permission Checking in Auth.js SDK
- CVE-2026-40155Auth0 Next.js SDK has Improper Proxy Cache Lookup
- CVE-2026-34236Auth0 PHP SDK Insufficient Entropy in Cookie Encryption
- CVE-2025-68129Auth0-PHP SDK has Improper Audience Validation
- CVE-2025-67716Auth0 Next.js SDK has Improper Validation of Query Parameters
- CVE-2025-67490Auth0 Next.js SDK has Improper Request Caching Lookup
- CVE-2025-65945auth0/node-jws improper HMAC signature verification vulnerability
- CVE-2025-58769auth0-PHP: Improper File Type Handling in Bulk User Import
- CVE-2025-48947NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies
- CVE-2025-48951Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
- CVE-2025-47275Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
- CVE-2025-46573passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smuggling
- CVE-2025-46572passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrapping
- CVE-2025-46344Auth0 NextJS SDK v4 Missing Session Invalidation
- CVE-2023-6813Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle
- CVE-2022-23539jsonwebtoken unrestricted key type could lead to legacy keys usage
- CVE-2022-23540jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()