Auth0

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Auth0 product.

RSS Feeds for Auth0 security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Auth0 products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Auth0 Sorted by Most Security Vulnerabilities since 2018

Nextjs Auth05 vulnerabilities

Login By Auth05 vulnerabilities

Auth0 Js5 vulnerabilities

Auth0 Lock4 vulnerabilities

Auth0 Jsonwebtoken4 vulnerabilities

Wp Auth02 vulnerabilities

Auth0 Express Openid Connect2 vulnerabilities

Auth0 Express Jwt1 vulnerability

Auth0 Wcf Service Jwt1 vulnerability

Auth0 Net1 vulnerability

Laravel Auth01 vulnerability

Auth0 Aspnet Owin1 vulnerability

Auth0 Aspnet1 vulnerability

Auth0 Angular Jwt1 vulnerability

Omniauth Auth01 vulnerability

Auth0 Passport Sharepoint1 vulnerability

Auth0 Passport Wsfed Saml21 vulnerability

Auth0 Adldap Connector1 vulnerability

By the Year

In 2026 there have been 9 vulnerabilities in Auth0 with an average score of 6.9 out of ten. Last year, in 2025 Auth0 had 5 security vulnerabilities published. That is, 4 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.20.

Year	Vulnerabilities	Average Score
2026	9	6.94
2025	5	5.74
2024	1	6.10
2023	0	0.00
2022	6	6.95
2021	4	6.78
2020	12	7.46
2019	3	0.00
2018	5	0.00

It may take a day or so for new Auth0 vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Auth0 Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-85473	Oct 13, 2026	DoS via Timestamp Claim Out-of-Range in Auth0 Java-JWT Library The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service.
CVE-2026-50157	Sep 14, 2026	Auth0 Symfony SDK 5.0.0-BETA05.9.0 Query-String OAuth Token Replay Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as the Authorization header for protected HTTP routes. Query-string tokens can be recorded in server logs, browser history, or referrer data and then replayed against protected API endpoints. This issue is fixed in version 5.9.0.
CVE-2026-84685	Sep 08, 2026	JS: react-native-auth0 In-Memory Token Cache Leak in SSR The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory can be retrieved across subsequent requests processed by the same server runtime.
CVE-2026-85983	Sep 08, 2026	Auth0 AD/LDAP Connector Config Overwrite Enables Privilege Escalation The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.
CVE-2026-85982	Sep 08, 2026	Auth0 AD/LDAP Connector Stored XSS via Unencoded Search Results The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs.
CVE-2026-85981	Sep 08, 2026	Auth0 AD/LDAP Connector 6.5.0 Local Loopback Auth Bypass The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings.
CVE-2026-42280	May 27, 2026	Auth0.js SDK Access Token Misuse via Invalid ID Token fixed in 10.0.0 Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.
CVE-2026-40155	Apr 17, 2026	Auth0 Next.js SDK nonce retry causing cache lookup flaw 4.12.0-4.17.1 The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.	Nextjs Auth0
CVE-2026-34236	Apr 01, 2026	Auth0PHP SDK 8.0.08.18.x: LowEntropy Cookie Encryption Vulnerability Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0.
CVE-2025-68129	Dec 17, 2025	Auth0-PHP v8.0.0v8.17.0 Improper Audience Validation in Access Tokens Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue.
CVE-2025-67716	Dec 11, 2025	Auth0 Next.js SDK 4.9.0-4.12.1 returnTo Validation Flaw (OAuth Params Injection) The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fixed in version 4.13.0.	Nextjs Auth0
CVE-2025-67490	Dec 10, 2025	Auth0 Next.js SDK 4.11.04.11.2/4.12.0 TokenCache Race Condition The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.	Nextjs Auth0
CVE-2025-65945	Dec 04, 2025	auth0/node-jws HS256 signature verification bypass (v3.2.2-3.2.3 / 4.0.0-4.0.1) auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.
CVE-2025-58769	Oct 01, 2025	Auth0-PHP SDK Bulk User Import Path Validation Flaw (v3.3.0-8.16.0) auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with the SDK does not validate the file-path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. The vulnerability affects any application that either directly uses the Auth0-PHP SDK (versions 3.3.08.16.0) or indirectly relies on those versions through the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs. This issue is fixed in version 8.17.0.	Laravel Auth0
CVE-2023-6813	Jul 10, 2024	WordPress Login by Auth0 Plugin XSS via wle param (<=4.6.0) The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the wle parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	Login By Auth0
CVE-2022-23539	Dec 23, 2022	jsonwebtoken 8.5.1 insecure key type misuse upgrade to 9.0.0 Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, youll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions.	Jsonwebtoken
CVE-2022-23540	Dec 22, 2022	jsonwebtoken <=8.5.1: none-algorithm bypass in jwt.verify() (fixed 9.0.0) In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you dont need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.	Jsonwebtoken
CVE-2022-23541	Dec 22, 2022	jsonwebtoken <=8.5.1 JWT Verification Bypass (Sym/Asym Mix) jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.	Jsonwebtoken
CVE-2022-23505	Dec 13, 2022	Remote Auth Bypass in Passport-wsfed-saml2 <4.6.3 (WSFed) Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround.	Passport Wsfed Saml2
CVE-2022-29172	May 05, 2022	Auth0 is an authentication broker Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before `11.33.0`, when the âadditional signup fieldsâ? feature [is configured](https://github.com/auth0/lock#additional-sign-up-fields), a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service `user_metdata` payload (using the `name` property). Verification emails, when applicable, are generated using this metadata. It is therefor possible for an actor to craft a malicious link by injecting HTML, which is then rendered as the recipient's name within the delivered email template. You are impacted by this vulnerability if you are using `auth0-lock` version `11.32.2` or lower and are using the âadditional signup fieldsâ? feature in your application. Upgrade to version `11.33.0`.	Lock
CVE-2022-24794	Mar 31, 2022	Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under `example.com` are protected with the `requiresAuth` middleware, a visit to `http://example.com//google.com` will be redirected to `google.com` after login because the original url reported by the Express framework is not properly sanitized. This vulnerability affects versions prior to 2.7.2. Users are advised to upgrade. There are no known workarounds.	Express Openid Connect
CVE-2021-43812	Dec 16, 2021	The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.	Nextjs Auth0
CVE-2021-41246	Dec 09, 2021	Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.	Express Openid Connect
CVE-2021-32702	Jun 25, 2021	The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message. You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower unless you are using custom error handling that does not return the error message in an HTML response. Upgrade to version `1.4.1` to resolve. The fix adds basic HTML escaping to the error message and it should not impact your users.	Nextjs Auth0
CVE-2021-32641	Jun 04, 2021	auth0-lock is Auth0's signin solution auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage` or the library's `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`. The vulnerability is patched in version 11.30.1.	Lock
CVE-2020-15259	Nov 06, 2020	ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidential data loss. CSRF exploits may occur if the user visits a malicious page containing CSRF payload on the same machine that has access to the ad-ldap-connector admin console via a browser. You may be affected if you use the admin console included with ad-ldap-connector versions <=5.0.12. If you do not have ad-ldap-connector admin console enabled or do not visit any other public URL while on the machine it is installed on, you are not affected. The issue is fixed in version 5.0.13.	Adldap Connector
CVE-2020-15240	Oct 21, 2020	omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all of the following conditions apply: 1. You are using `omniauth-auth0`. 2. You are using `JWTValidator.verify` method directly OR you are not authenticating using the SDKs default Authorization Code Flow. The issue is patched in version 2.4.1.	Omniauth Auth0
CVE-2020-15119	Aug 20, 2020	In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.	Lock
CVE-2020-15084	Jun 30, 2020	In express-jwt (NPM package) up and including version 5.3.3 In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have algorithms configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the secret. You can fix this by specifying algorithms in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.	Express Jwt
CVE-2020-5263	Apr 09, 2020	auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification, the application risks password exposure. This is fixed in version 9.12.3	Auth0 Js
CVE-2020-7948	Apr 01, 2020	An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference.	Login By Auth0
CVE-2020-7947	Apr 01, 2020	An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at least) CSV injection if a crafted Excel document is uploaded.	Login By Auth0
CVE-2020-6753	Apr 01, 2020	The Login by Auth0 plugin before 4.0.0 for WordPress The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.	Login By Auth0
CVE-2020-5392	Apr 01, 2020	A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page.	Wp Auth0
CVE-2020-5391	Apr 01, 2020	Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.	Wp Auth0
CVE-2019-20173	Feb 05, 2020	The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.	Login By Auth0
CVE-2019-20174	Feb 03, 2020	Auth0 Lock before 11.21.0 Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.	Lock
CVE-2019-16929	Oct 08, 2019	Auth0 auth0.net before 6.5.4 has Incorrect Access Control Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens.	Auth0 Net
CVE-2019-13483	Jul 25, 2019	Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.	Passport Sharepoint
CVE-2019-7644	Apr 11, 2019	Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application.	Auth0 Wcf Service Jwt
CVE-2018-15121	Aug 29, 2018	An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.	Aspnet Owin Aspnet
CVE-2018-11537	Jun 19, 2018	Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.	Angular Jwt
CVE-2018-6874	Apr 04, 2018	CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.	Auth0 Js
CVE-2018-6873	Apr 04, 2018	The Auth0 authentication service before 2017-10-15 The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.	Auth0 Js
CVE-2018-7307	Mar 06, 2018	The Auth0 Auth0.js library before 9.3 has CSRF The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.	Auth0 Js
CVE-2017-17068	Dec 06, 2017	A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12 A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback().	Auth0 Js