# cve.now: Auth0

The newest entries naming Auth0 as an affected vendor (up to 200), of 44 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-126129](https://cve.now/CVE-2026-126129.md): The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a… (no CVSS)
- [CVE-2026-126128](https://cve.now/CVE-2026-126128.md): The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management… (no CVSS)
- [CVE-2026-108167](https://cve.now/CVE-2026-108167.md): The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when… (no CVSS)
- [CVE-2026-107372](https://cve.now/CVE-2026-107372.md): The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during… (no CVSS)
- [CVE-2026-85473](https://cve.now/CVE-2026-85473.md): Out-of-Range Timestamp Claim Handling in auth0/java-jwt (CVSS 5.3)
- [CVE-2026-107371](https://cve.now/CVE-2026-107371.md): Missing Verification of auth\_time Claim in auth0.js (CVSS 5.4)
- [CVE-2026-107370](https://cve.now/CVE-2026-107370.md): Improper Request Handling for Active Directory Logins in auth0-lock (CVSS 5.3)
- [CVE-2026-107369](https://cve.now/CVE-2026-107369.md): Improper Validation of Post-Login Redirect URL in nextjs-auth0 (CVSS 6.1)
- [CVE-2026-50157](https://cve.now/CVE-2026-50157.md): Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK (CVSS 6.5)
- [CVE-2026-84685](https://cve.now/CVE-2026-84685.md): Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management (CVSS 6.5)
- [CVE-2026-85983](https://cve.now/CVE-2026-85983.md): Local Privilege Escalation in Auth0 AD/LDAP Connector (CVSS 7.8)
- [CVE-2026-85982](https://cve.now/CVE-2026-85982.md): Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector (CVSS 9.0)
- [CVE-2026-85981](https://cve.now/CVE-2026-85981.md): Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector (CVSS 6.7)
- [CVE-2026-42280](https://cve.now/CVE-2026-42280.md): Improper Permission Checking in Auth.js SDK (CVSS 7.1)
- [CVE-2026-40155](https://cve.now/CVE-2026-40155.md): Auth0 Next.js SDK has Improper Proxy Cache Lookup (CVSS 5.4)
- [CVE-2026-34236](https://cve.now/CVE-2026-34236.md): Auth0 PHP SDK Insufficient Entropy in Cookie Encryption (CVSS 8.2)
- [CVE-2025-68129](https://cve.now/CVE-2025-68129.md): Auth0-PHP SDK has Improper Audience Validation (CVSS 6.8)
- [CVE-2025-67716](https://cve.now/CVE-2025-67716.md): Auth0 Next.js SDK has Improper Validation of Query Parameters (CVSS 5.7)
- [CVE-2025-67490](https://cve.now/CVE-2025-67490.md): Auth0 Next.js SDK has Improper Request Caching Lookup (CVSS 5.4)
- [CVE-2025-65945](https://cve.now/CVE-2025-65945.md): auth0/node-jws improper HMAC signature verification vulnerability (CVSS 7.5)
- [CVE-2025-58769](https://cve.now/CVE-2025-58769.md): auth0-PHP: Improper File Type Handling in Bulk User Import (CVSS 3.3)
- [CVE-2025-48947](https://cve.now/CVE-2025-48947.md): NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies (CVSS 7.7)
- [CVE-2025-48951](https://cve.now/CVE-2025-48951.md): Auth0-PHP SDK Deserialization of Untrusted Data vulnerability (CVSS 9.3)
- [CVE-2025-47275](https://cve.now/CVE-2025-47275.md): Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK (CVSS 9.1)
- [CVE-2025-46573](https://cve.now/CVE-2025-46573.md): passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smuggling (CVSS 8.6)
- [CVE-2025-46572](https://cve.now/CVE-2025-46572.md): passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrapping (CVSS 9.3)
- [CVE-2025-46344](https://cve.now/CVE-2025-46344.md): Auth0 NextJS SDK v4 Missing Session Invalidation (CVSS 4.9)
- [CVE-2023-6813](https://cve.now/CVE-2023-6813.md): Login by Auth0 \<= 4.6.0 - Reflected Cross-Site Scripting via wle (CVSS 6.1)
- [CVE-2022-23539](https://cve.now/CVE-2022-23539.md): jsonwebtoken unrestricted key type could lead to legacy keys usage (CVSS 5.9)
- [CVE-2022-23540](https://cve.now/CVE-2022-23540.md): jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() (CVSS 6.4)
- [CVE-2022-23541](https://cve.now/CVE-2022-23541.md): jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC (CVSS 5.0)
- [CVE-2022-23505](https://cve.now/CVE-2022-23505.md): Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication (CVSS 5.3)
- [CVE-2022-29172](https://cve.now/CVE-2022-29172.md): HTML injection with additional signup fields (CVSS 6.1)
- [CVE-2022-24794](https://cve.now/CVE-2022-24794.md): Open Redirect in express-openid-connect (CVSS 7.5)
- [CVE-2021-43812](https://cve.now/CVE-2021-43812.md): Open redirect in nextjs-auth0 (CVSS 6.4)
- [CVE-2021-41246](https://cve.now/CVE-2021-41246.md): Session fixation in express-openid-connect (CVSS 4.6)
- [CVE-2021-32702](https://cve.now/CVE-2021-32702.md): Reflected XSS from the callback handler's error query parameter (CVSS 8.0)
- [CVE-2021-32641](https://cve.now/CVE-2021-32641.md): Reflected XSS when using flashMessages (CVSS 8.1)
- [CVE-2020-15259](https://cve.now/CVE-2020-15259.md): CSRF in Auth0 ad-ldap-connector (CVSS 8.1)
- [CVE-2020-15240](https://cve.now/CVE-2020-15240.md): Regression in JWT Signature Validation (CVSS 7.4)
- [CVE-2020-15119](https://cve.now/CVE-2020-15119.md): DOM-based XSS in auth0-lock (CVSS 6.4)
- [CVE-2020-15125](https://cve.now/CVE-2020-15125.md): Authorization header is not sanitized in an error object in auth0 (CVSS 7.7)
- [CVE-2020-15084](https://cve.now/CVE-2020-15084.md): Authorization bypass in express-jwt (CVSS 7.7)
- [CVE-2020-5263](https://cve.now/CVE-2020-5263.md): Information disclosure through error object (CVSS 5.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/auth0
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.