Login Request a demo
AU
Vendor
auth0
26 products with CVEs on record
65
CVEs
0
On KEV
4
New 30D
Products
AU
auth0.js
auth0
9.8
8 CVEs0 on KEV1 new
NE
nextjs-auth0
auth0
7.7
8 CVEs0 on KEV1 new
AU
auth0-lock
Auth0
5.3
1 CVEs0 on KEV1 new
JA
java-jwt
Auth0
5.3
1 CVEs0 on KEV1 new
LB
Login by Auth0
auth0
9.8
5 CVEs0 on KEV0 new
AU
auth0-PHP
auth0
9.8
4 CVEs0 on KEV0 new
JS
Jsonwebtoken
Auth0
9.8
4 CVEs0 on KEV0 new
LO
lock
auth0
6.1
4 CVEs0 on KEV0 new
PA
passport-wsfed-saml2
auth0
9.3
4 CVEs0 on KEV0 new
AA
Auth0 AD/LDAP Connector
Auth0
9.0
3 CVEs0 on KEV0 new
NO
node-jsonwebtoken
auth0
8.1
3 CVEs0 on KEV0 new
WP
Wp-auth0
Auth0
8.8
3 CVEs0 on KEV0 new
EX
express-openid-connect
auth0
8.8
2 CVEs0 on KEV0 new
LA
laravel-auth0
auth0
7.5
2 CVEs0 on KEV0 new
SY
symfony
auth0
7.5
2 CVEs0 on KEV0 new
AD
ad-ldap-connector
auth0
8.8
1 CVEs0 on KEV0 new
AN
Angular-jwt
Auth0
6.5
1 CVEs0 on KEV0 new
AS
Aspnet
Auth0
8.8
1 CVEs0 on KEV0 new
AS
Aspnet-owin
Auth0
8.8
1 CVEs0 on KEV0 new
AU
Auth0.net
Auth0
7.5
1 CVEs0 on KEV0 new
AU
Auth0-wcf-service-jwt
Auth0
9.8
1 CVEs0 on KEV0 new
EX
Express-jwt
Auth0
9.1
1 CVEs0 on KEV0 new
NO
node-jws
auth0
7.5
1 CVEs0 on KEV0 new
OM
omniauth-auth0
auth0
9.1
1 CVEs0 on KEV0 new
PA
Passport-sharepoint
Auth0
7.3
1 CVEs0 on KEV0 new
RE
react-native-auth0
Auth0
6.5
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-85473
JA
java-jwt
Auth0
5.3
0%
Oct 13Out-of-Range Timestamp Claim Handling in auth0/java-jwt
CVE-2026-107371
AU
auth0.js
Auth0
5.4
0%
Oct 13Missing Verification of auth_time Claim in auth0.js
CVE-2026-107370
AU
auth0-lock
Auth0
5.3
0%
Oct 13Improper Request Handling for Active Directory Logins in auth0-lock
CVE-2026-107369
NE
nextjs-auth0
Auth0
6.1
0%
Oct 13Improper Validation of Post-Login Redirect URL in nextjs-auth0
CVE-2026-50157
SY
symfony
auth0
6.5
1%
Sep 14Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK
CVE-2026-84685
RE
react-native-auth0
Auth0
6.5
0%
Sep 8Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management
CVE-2026-85983
AA
Auth0 AD/LDAP Connector
Auth0
7.8
0%
Sep 8Local Privilege Escalation in Auth0 AD/LDAP Connector
CVE-2026-85982
AA
Auth0 AD/LDAP Connector
Auth0
9.0
0%
Sep 8Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
CVE-2026-85981
AA
Auth0 AD/LDAP Connector
Auth0
6.7
0%
Sep 8Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector
CVE-2026-42280
AU
auth0.js
auth0
7.1
0%
May 27Improper Permission Checking in Auth.js SDK
CVE-2026-40155
NE
nextjs-auth0
auth0
5.4
0%
Apr 17Auth0 Next.js SDK has Improper Proxy Cache Lookup
CVE-2026-34236
AU
auth0-PHP
auth0
9.8
0%
Apr 1Auth0 PHP SDK Insufficient Entropy in Cookie Encryption
CVE-2025-68129
AU
auth0-PHP
auth0
7.5
0%
Dec 17Auth0-PHP SDK has Improper Audience Validation
CVE-2025-67716
NE
nextjs-auth0
auth0
5.7
0%
Dec 11Auth0 Next.js SDK has Improper Validation of Query Parameters
CVE-2025-67490
NE
nextjs-auth0
auth0
5.4
0%
Dec 10Auth0 Next.js SDK has Improper Request Caching Lookup
CVE-2025-65945
NO
node-jws
auth0
7.5
0%
Dec 4auth0/node-jws improper HMAC signature verification vulnerability
CVE-2025-58769
LA
laravel-auth0
auth0
3.3
0%
Oct 1auth0-PHP: Improper File Type Handling in Bulk User Import
CVE-2025-48947
NE
nextjs-auth0
auth0
7.7
0%
Jun 4NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies
CVE-2025-48951
AU
auth0-PHP
auth0
9.3
1%
Jun 3Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
CVE-2025-47275
AU
auth0-PHP
auth0
9.1
1%
May 15Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
CVE-2025-46573
PA
passport-wsfed-saml2
auth0
8.6
0%
May 6passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smuggling
CVE-2025-46572
PA
passport-wsfed-saml2
auth0
9.3
0%
May 6passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrapping
CVE-2025-46344
NE
nextjs-auth0
auth0
4.9
0%
Apr 29Auth0 NextJS SDK v4 Missing Session Invalidation
CVE-2023-6813
LB
Login by Auth0
auth0
6.1
0%
Jul 10Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle
CVE-2022-23539
NO
node-jsonwebtoken
auth0
8.1
1%
Dec 22jsonwebtoken unrestricted key type could lead to legacy keys usage
CVE-2022-23540
NO
node-jsonwebtoken
auth0
7.6
1%
Dec 22jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()
CVE-2022-23541
NO
node-jsonwebtoken
auth0
6.3
1%
Dec 22jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
CVE-2022-23505
PA
passport-wsfed-saml2
auth0
7.5
1%
Dec 13Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication
CVE-2022-29172
LO
lock
auth0
6.1
1%
May 5HTML injection with additional signup fields
CVE-2022-24794
EX
express-openid-connect
auth0
6.1
1%
Mar 31Open Redirect in express-openid-connect
CVE-2021-43812
NE
nextjs-auth0
auth0
6.1
1%
Dec 16Open redirect in nextjs-auth0
CVE-2021-41246
EX
express-openid-connect
auth0
8.8
1%
Dec 9Session fixation in express-openid-connect
CVE-2021-32702
NE
nextjs-auth0
auth0
6.1
1%
Jun 25Reflected XSS from the callback handler's error query parameter
CVE-2021-32641
LO
lock
auth0
6.1
2%
Jun 4Reflected XSS when using flashMessages
CVE-2020-15259
AD
ad-ldap-connector
auth0
8.8
1%
Nov 6CSRF in Auth0 ad-ldap-connector
CVE-2020-15240
OM
omniauth-auth0
auth0
9.1
1%
Oct 21Regression in JWT Signature Validation
CVE-2020-15119
LO
lock
auth0
5.4
1%
Aug 19DOM-based XSS in auth0-lock
CVE-2020-15125
AU
Auth0.js
Auth0
7.7
2%
Jul 29In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used
CVE-2020-15084
EX
Express-jwt
Auth0
9.1
1%
Jun 30In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced
CVE-2020-5263
AU
Auth0.js
Auth0
4.9
1%
Apr 9auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability
CVE-2020-7948
LB
Login BY Auth0
Auth0
8.8
2%
Apr 1An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress
CVE-2020-7947
LB
Login BY Auth0
Auth0
9.8
3%
Apr 1An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress
CVE-2020-6753
LB
Login BY Auth0
Auth0
6.1
1%
Apr 1The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392
CVE-2020-5392
WP
Wp-auth0
Auth0
6.1
1%
Apr 1A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page
CVE-2020-5391
WP
Wp-auth0
Auth0
8.8
1%
Apr 1Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field
CVE-2019-20173
LB
Login BY Auth0
Auth0
6.1
2%
Feb 5The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php
CVE-2019-20174
LO
Lock
Auth0
6.1
1%
Feb 3Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder
CVE-2019-16929
AU
Auth0.net
Auth0
7.5
1%
Oct 8Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens
CVE-2019-13483
PA
Passport-sharepoint
Auth0
7.3
1%
Jul 25Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing
CVE-2019-7644
AU
Auth0-wcf-service-jwt
Auth0
9.8
2%
Apr 11Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature
CVE-2018-15121
AS
Aspnet
Auth0
8.8
0%
Aug 29An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin
CVE-2018-11537
AN
Angular-jwt
Auth0
6.5
1%
Jun 19Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the…
CVE-2015-9235
JS
Jsonwebtoken
Auth0
9.8
9%
May 29In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms…
CVE-2018-6874
AU
Auth0.js
Auth0
8.8
1%
Apr 4CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled
CVE-2018-6873
AU
Auth0.js
Auth0
9.8
2%
Apr 4The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated
CVE-2018-7307
AU
Auth0.js
Auth0
8.8
1%
Mar 6The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter
CVE-2017-16897
PA
Passport-wsfed-saml2
Auth0
8.1
1%
Dec 27A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5
CVE-2017-17068
AU
Auth0.js
Auth0
7.5
1%
Dec 6A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12