# CVE-2026-126129: Auth0 ASP.NET Core Authentication SDK session revocation bypass

Source: https://junglewise.ai/threats/cve-2026-126129-the-auth0-asp-net-core-authentication-sdk-incorrectly-determines  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-126129 · Severity: info · Published 2026-11-10

The Auth0 ASP.NET Core Authentication SDK is used by web applications to handle user authentication and session management. A flaw in its OIDC back-channel logout handling allows an attacker with a previously issued session cookie to access protected endpoints even after the session has been revoked, potentially gaining unauthorized access to sensitive application features or data.

Vendors: [Auth0](https://junglewise.ai/threats/vendors/auth0).

## Quick answers

**Is CVE-2026-126129 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126129 being exploited in the wild.

**How severe is CVE-2026-126129?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Auth0 ASP.NET Core Authentication SDK prior to 1.12.0.

**Is there a fix for CVE-2026-126129?** Yes: fixed in Auth0 ASP.NET Core Authentication SDK 1.12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126129 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126129?** Check whether you run Auth0 ASP.NET Core Authentication SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Auth0 ASP.NET Core Authentication SDK 1.12.0

## Technical details

The SDK incorrectly determines whether a session has been revoked through OIDC back-channel logout, allowing revoked session cookies to be accepted. The vulnerability requires three preconditions: back-channel logout must be enabled, the application must use a multi-tenant custom-domain configuration that resolves the Auth0 domain from untrusted request attributes like the Host header, and an attacker must possess a session cookie from a revoked session. This is a session validation bypass arising from improper reliance on untrusted input in the revocation check.

## Affected products

- Auth0 ASP.NET Core Authentication SDK prior to 1.12.0

## Timeline

- 2026-11-10: disclosed

## References

- [https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129](https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129)