Auth0
49 CVEs across 26 Auth0 products. Browse Auth0 vulnerabilities, severities, and proof-of-concept exploits.
Auth0 products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42280 | High | 7.1 | 2026-05-27 | Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profil… |
CVE-2026-40155 | Medium | 5.4 | 2026-04-17 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that… |
CVE-2026-34236 | High | 8.2 | 2026-04-01 | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK… |
CVE-2025-68129 | Medium | 6.8 | 2025-12-17 | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is… |
CVE-2025-67716 | Medium | 5.7 | 2025-12-11 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw… |
CVE-2025-67490 | Medium | 5.4 | 2025-12-10 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultan… |
CVE-2025-65945 | High | 7.5 | 2025-12-04 | auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature ve… |
CVE-2025-58769 | Low | 3.3 | 2025-10-01 | auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with th… |
CVE-2025-48947 | | 2025-06-04 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session`… | |
CVE-2025-48951 | | 2025-06-03 | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserializatio… | |
CVE-2025-47275 | Critical | 9.1 | 2025-05-15 | Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of ap… |
CVE-2025-46573 | | 2025-05-06 | passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including versi… | |
CVE-2025-46572 | | 2025-05-06 | passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including versi… | |
CVE-2025-46344 | | 2025-04-29 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke… | |
CVE-2023-6813 | Medium | 6.1 | 2024-07-10 | The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter in all versions up to, and including, 4.6.0 due… |
CVE-2022-23539 | Medium | 5.9 | 2022-12-23 | Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA ke… |
CVE-2022-23540 | Medium | 6.4 | 2022-12-22 | In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to def… |
CVE-2022-23541 | Medium | 5.0 | 2022-12-22 | jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented k… |
CVE-2022-23505 | Medium | 5.3 | 2022-12-13 | Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be ab… |
CVE-2022-29172 | Medium | 6.1 | 2022-05-05 | Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. I… |
CVE-2022-24794 | High | 7.5 | 2022-03-31 | Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, eith… |
CVE-2021-43812 | Medium | 6.4 | 2021-12-16 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo param… |
CVE-2021-41246 | Medium | 4.6 | 2021-12-09 | Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not re… |
CVE-2021-32702 | High | 8.0 | 2021-06-25 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflec… |
CVE-2021-32641 | High | 8.1 | 2021-06-04 | auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrar… |
CVE-2020-15259 | High | 8.1 | 2020-11-06 | ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidentia… |
CVE-2020-15240 | High | 7.4 | 2020-10-21 | omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method. Improper vali… |
CVE-2020-15119 | Medium | 6.4 | 2020-08-20 | In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application a… |
CVE-2020-15125 | High | 7.7 | 2020-07-29 | In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is us… |
CVE-2020-15084 | High | 7.7 | 2020-06-30 | In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms i… |
CVE-2020-5263 | Medium | 5.5 | 2020-04-09 | auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error o… |
CVE-2020-7948 | High | 8.8 | 2020-04-01 | An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference. |
CVE-2020-7947 | Critical | 9.8 | 2020-04-01 | An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sou… |
CVE-2020-6753 | Medium | 6.1 | 2020-04-01 | The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392. |
CVE-2020-5392 | Medium | 6.1 | 2020-04-01 | A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page. |
CVE-2020-5391 | High | 8.8 | 2020-04-01 | Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field. |
CVE-2019-20173 | Medium | 6.1 | 2020-02-05 | The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php. |
CVE-2019-20174 | Medium | 6.1 | 2020-02-03 | Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder. |
CVE-2019-16929 | High | 7.5 | 2019-10-08 | Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens. |
CVE-2019-13483 | High | 7.3 | 2019-07-25 | Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypa… |
CVE-2019-7644 | Critical | 9.8 | 2019-04-11 | Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this e… |
CVE-2018-15121 | High | 8.8 | 2018-08-29 | An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID C… |
CVE-2018-11537 | Medium | 6.5 | 2018-06-19 | Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorPro… |
CVE-2015-9235 | Critical | 9.8 | 2018-05-29 | In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES fami… |
CVE-2018-6874 | High | 8.8 | 2018-04-04 | CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. |
CVE-2018-6873 | Critical | 9.8 | 2018-04-04 | The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated. |
CVE-2018-7307 | High | 8.8 | 2018-03-06 | The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter. |
CVE-2017-16897 | High | 8.1 | 2017-12-27 | A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate… |
CVE-2017-17068 | High | 7.5 | 2017-12-06 | A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire auth… |