Auth0 Lock
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Auth0 Lock.
By the Year
In 2026 there have been 0 vulnerabilities in Auth0 Lock. Lock did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 0 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 1 | 6.10 |
| 2021 | 1 | 6.10 |
| 2020 | 2 | 5.40 |
It may take a day or so for new Lock vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Auth0 Lock Security Vulnerabilities
Auth0 is an authentication broker
CVE-2022-29172
6.1 - Medium
- May 05, 2022
Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before `11.33.0`, when the âadditional signup fieldsâ? feature [is configured](https://github.com/auth0/lock#additional-sign-up-fields), a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service `user_metdata` payload (using the `name` property). Verification emails, when applicable, are generated using this metadata. It is therefor possible for an actor to craft a malicious link by injecting HTML, which is then rendered as the recipient's name within the delivered email template. You are impacted by this vulnerability if you are using `auth0-lock` version `11.32.2` or lower and are using the âadditional signup fieldsâ? feature in your application. Upgrade to version `11.33.0`.
XSS
auth0-lock is Auth0's signin solution
CVE-2021-32641
6.1 - Medium
- June 04, 2021
auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage` or the library's `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`. The vulnerability is patched in version 11.30.1.
XSS
In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM
CVE-2020-15119
5.4 - Medium
- August 20, 2020
In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.
XSS
Auth0 Lock before 11.21.0
CVE-2019-20174
- February 03, 2020
Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Auth0 Lock or by Auth0? Click the Watch button to subscribe.
