# CVE-2022-29172: Auth0 Lock cross-site scripting via additional signup fields

Source: https://junglewise.ai/threats/cve-2022-29172-auth0-lock-cross-site-scripting-via-additional-signup-fields  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-29172 · Severity: low · CVSS 3.1 · Published 2022-05-24

Auth0 Lock is a widely-used authentication UI widget used by applications to handle user sign-up and login. When the "additional signup fields" feature is enabled, malicious users can inject unvalidated HTML code that gets stored in user metadata and rendered in verification emails, potentially allowing attackers to send phishing emails or trick users into clicking malicious links that appear to come from legitimate sources.

Technologies: [Auth0 Lock](https://junglewise.ai/threats/technologies/lock), [auth0-lock (npm)](https://junglewise.ai/threats/technologies/auth0-lock). Vendors: [Auth0](https://junglewise.ai/threats/vendors/auth0), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-29172 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-29172 being exploited in the wild.

**How severe is CVE-2022-29172?** Low severity, with a CVSS score of 3.1, published 24 May 2022.

**Which products and versions are affected?** Auth0 Lock 11.32.2 and earlier; auth0-lock (npm) SEMVER:introduced=0,fixed=11.33.0.

**Is there a fix for CVE-2022-29172?** Yes. auth0-lock (npm): upgrade to 11.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-29172 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-29172?** Check whether you run Auth0 Lock or auth0-lock (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- auth0-lock (npm): upgrade to 11.33.0 or later

  ```sh
  npm install auth0-lock@11.33.0
  ```


## Technical details

This is a cross-site scripting (CWE-79) vulnerability in the additional signup fields feature of Auth0 Lock. The vulnerability exists because user input provided in additional signup fields is not properly sanitized before being stored in the service's user_metadata payload. When verification emails are generated, this unsanitized metadata (specifically the name property) is rendered directly into the email template without HTML escaping. An attacker can craft a malicious signup request injecting HTML/JavaScript into these fields, which is then delivered to victims via email, potentially enabling phishing attacks or credential theft. The fix, released in version 11.33.0, strips HTML tags from user input in additional signup fields on the signup tab.

## Affected products

- Auth0 Lock 11.32.2 and earlier

## Identifiers

- CVE-2022-29172
- GHSA-7ww6-75fj-jcj7

## Timeline

- 2022-05-05: disclosed
- 2022-05-24: advisory
- 2022-05-24: patched: Version 11.33.0 released

## References

- [https://github.com/auth0/lock/security/advisories/GHSA-7ww6-75fj-jcj7](https://github.com/auth0/lock/security/advisories/GHSA-7ww6-75fj-jcj7)

## Related threats

- [Auth0 lock improper request handling in Active Directory logins](https://junglewise.ai/threats/cve-2026-107370-when-a-username-for-an-active-directory-connection-is-a-domain)
- [Auth0 Lock reflected XSS in flashMessages and languageDictionary](https://junglewise.ai/threats/cve-2021-32641-auth0-lock-reflected-xss-in-flashmessages-and-languagedictionary)
- [Auth0 auth0-lock DOM-based XSS in Passwordless and Enterprise connections](https://junglewise.ai/threats/cve-2020-15119-auth0-auth0-lock-dom-based-xss-in-passwordless-and-enterprise)
- [Auth0 Lock XSS in unsanitized placeholder property](https://junglewise.ai/threats/cve-2019-20174-auth0-lock-xss-in-unsanitized-placeholder-property)