Auth0 vulnerabilities
44 CVEs and advisories name Auth0 as an affected vendor, newest first. Follow it as a feed.
- CVE-2022-23541jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
- CVE-2022-23505Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication
- CVE-2022-29172HTML injection with additional signup fields
- CVE-2022-24794Open Redirect in express-openid-connect
- CVE-2021-43812Open redirect in nextjs-auth0
- CVE-2021-41246Session fixation in express-openid-connect
- CVE-2021-32702Reflected XSS from the callback handler's error query parameter
- CVE-2021-32641Reflected XSS when using flashMessages
- CVE-2020-15259CSRF in Auth0 ad-ldap-connector
- CVE-2020-15240Regression in JWT Signature Validation
- CVE-2020-15119DOM-based XSS in auth0-lock
- CVE-2020-15125Authorization header is not sanitized in an error object in auth0
- CVE-2020-15084Authorization bypass in express-jwt
- CVE-2020-5263Information disclosure through error object