auth0 vulnerabilities

CVEs per yearBy the year they were published

1. 20206
2. 20214
3. 20226
4. 20241
5. 202511
6. 202612

Newest CVEs

• CVE-2026-85473

  Out-of-Range Timestamp Claim Handling in auth0/java-jwt

  Auth0 · java-jwt

  Medium5.3
• CVE-2026-107371

  Missing Verification of auth_time Claim in auth0.js

  Auth0 · auth0.js

  Medium5.4
• CVE-2026-107370

  Improper Request Handling for Active Directory Logins in auth0-lock

  Auth0 · auth0-lock

  Medium5.3
• CVE-2026-107369

  Improper Validation of Post-Login Redirect URL in nextjs-auth0

  Auth0 · nextjs-auth0

  Medium6.1
• CVE-2026-50157

  Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK

  auth0 · symfony

  Medium6.5
• CVE-2026-84685

  Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management

  Auth0 · react-native-auth0

  Medium6.5
• CVE-2026-85983

  Local Privilege Escalation in Auth0 AD/LDAP Connector

  Auth0 · Auth0 AD/LDAP Connector

  High7.8
• CVE-2026-85982

  Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector

  Auth0 · Auth0 AD/LDAP Connector

  Critical9.0
• CVE-2026-85981

  Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector

  Auth0 · Auth0 AD/LDAP Connector

  Medium6.7
• CVE-2026-42280

  Improper Permission Checking in Auth.js SDK

  auth0 · auth0.js

  High7.1