Is CVE-2026-107370 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107370 being exploited in the wild.

How severe is CVE-2026-107370?

Medium severity, with a CVSS score of 5.3, published 13 October 2026.

Which products and versions are affected?

Auth0 Lock 10.9.0 through 15.0.1.

Is there a fix for CVE-2026-107370?

Yes: fixed in lock 13.2.1, 15.0.2 and greater. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107370 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107370?

Check whether you run Auth0 Lock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107370: Auth0 lock improper request handling in Active Directory logins

CVE-2026-107370 · Severity: medium · CVSS 5.3 · Published 2026-10-13

Auth0 lock is a JavaScript library that handles user authentication for applications. When a user attempts to log in to an Active Directory connection using only a domain name (without a username part), the library mistakenly sends their credentials as visible URL parameters instead of securely in the request body, exposing sensitive login information to server logs and potential network interception.

Technologies: Auth0 Lock. Vendors: Auth0.

Quick answers

Is CVE-2026-107370 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107370 being exploited in the wild.
How severe is CVE-2026-107370?: Medium severity, with a CVSS score of 5.3, published 13 October 2026.
Which products and versions are affected?: Auth0 Lock 10.9.0 through 15.0.1.
Is there a fix for CVE-2026-107370?: Yes: fixed in lock 13.2.1, 15.0.2 and greater. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107370 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107370?: Check whether you run Auth0 Lock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: lock 13.2.1, 15.0.2 and greater

Technical details

The vulnerability occurs in auth0-lock versions 10.9.0 through 15.0.1 when an Active Directory login form receives a username consisting only of a domain (e.g., @corp.com). Instead of using a POST request to transmit form data securely in the request body, the library uses a GET request, causing credentials to be appended as query string parameters in the URL. This exposes sensitive authentication data to server logs, browser history, and network monitoring tools.

Affected products

Auth0 lock 10.9.0 through 15.0.1

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.