# CVE-2026-107370: Auth0 lock improper request handling in Active Directory logins

Source: https://junglewise.ai/threats/cve-2026-107370-when-a-username-for-an-active-directory-connection-is-a-domain  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107370 · Severity: medium · CVSS 5.3 · Published 2026-10-13

Auth0 lock is a JavaScript library that handles user authentication for applications. When a user attempts to log in to an Active Directory connection using only a domain name (without a username part), the library mistakenly sends their credentials as visible URL parameters instead of securely in the request body, exposing sensitive login information to server logs and potential network interception.

Technologies: [Auth0 Lock](https://junglewise.ai/threats/technologies/lock). Vendors: [Auth0](https://junglewise.ai/threats/vendors/auth0).

## Quick answers

**Is CVE-2026-107370 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107370 being exploited in the wild.

**How severe is CVE-2026-107370?** Medium severity, with a CVSS score of 5.3, published 13 October 2026.

**Which products and versions are affected?** Auth0 Lock 10.9.0 through 15.0.1.

**Is there a fix for CVE-2026-107370?** Yes: fixed in lock 13.2.1, 15.0.2 and greater. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107370 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107370?** Check whether you run Auth0 Lock at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in lock 13.2.1, 15.0.2 and greater

## Technical details

The vulnerability occurs in auth0-lock versions 10.9.0 through 15.0.1 when an Active Directory login form receives a username consisting only of a domain (e.g., @corp.com). Instead of using a POST request to transmit form data securely in the request body, the library uses a GET request, causing credentials to be appended as query string parameters in the URL. This exposes sensitive authentication data to server logs, browser history, and network monitoring tools.

## Affected products

- Auth0 lock 10.9.0 through 15.0.1

## Timeline

- 2026-10-13: disclosed

## References

- [https://github.com/auth0/lock/security/advisories/GHSA-mp8m-wcxp-w648](https://github.com/auth0/lock/security/advisories/GHSA-mp8m-wcxp-w648)
- [https://trust.okta.com/security-advisories/improper-request-handling-for-active-directory-logins-in-auth0-lock-cve-2026-107370](https://trust.okta.com/security-advisories/improper-request-handling-for-active-directory-logins-in-auth0-lock-cve-2026-107370)

## Related threats

- [Auth0 Lock cross-site scripting via additional signup fields](https://junglewise.ai/threats/cve-2022-29172-auth0-lock-cross-site-scripting-via-additional-signup-fields)
- [Auth0 Lock reflected XSS in flashMessages and languageDictionary](https://junglewise.ai/threats/cve-2021-32641-auth0-lock-reflected-xss-in-flashmessages-and-languagedictionary)
- [Auth0 Lock XSS in unsanitized placeholder property](https://junglewise.ai/threats/cve-2019-20174-auth0-lock-xss-in-unsanitized-placeholder-property)