Is CVE-2026-126129 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126129 being exploited in the wild.

How severe is CVE-2026-126129?

Informational severity, published 10 November 2026.

Which products and versions are affected?

Auth0 ASP.NET Core Authentication SDK prior to 1.12.0.

Is there a fix for CVE-2026-126129?

Yes: fixed in Auth0 ASP.NET Core Authentication SDK 1.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126129 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126129?

Check whether you run Auth0 ASP.NET Core Authentication SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126129: Auth0 ASP.NET Core Authentication SDK session revocation bypass

CVE-2026-126129 · Severity: info · Published 2026-11-10

The Auth0 ASP.NET Core Authentication SDK is used by web applications to handle user authentication and session management. A flaw in its OIDC back-channel logout handling allows an attacker with a previously issued session cookie to access protected endpoints even after the session has been revoked, potentially gaining unauthorized access to sensitive application features or data.

Vendors: Auth0.

Quick answers

Is CVE-2026-126129 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126129 being exploited in the wild.
How severe is CVE-2026-126129?: Informational severity, published 10 November 2026.
Which products and versions are affected?: Auth0 ASP.NET Core Authentication SDK prior to 1.12.0.
Is there a fix for CVE-2026-126129?: Yes: fixed in Auth0 ASP.NET Core Authentication SDK 1.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126129 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126129?: Check whether you run Auth0 ASP.NET Core Authentication SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Auth0 ASP.NET Core Authentication SDK 1.12.0

Technical details

The SDK incorrectly determines whether a session has been revoked through OIDC back-channel logout, allowing revoked session cookies to be accepted. The vulnerability requires three preconditions: back-channel logout must be enabled, the application must use a multi-tenant custom-domain configuration that resolves the Auth0 domain from untrusted request attributes like the Host header, and an attacker must possess a session cookie from a revoked session. This is a session validation bypass arising from improper reliance on untrusted input in the revocation check.

Affected products

Auth0 ASP.NET Core Authentication SDK prior to 1.12.0

Timeline

2026-11-10: disclosed

References

https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.