{"schema_version":1,"title":"Auth0 vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 15 vulnerabilities in Auth0: 0 in the last 7 days and 5 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-50157, was published on 14 September 2026. 3 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/auth0","json_url":"https://junglewise.ai/threats/vendors/auth0.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/auth0","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":2,"all_time":15,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":5,"last_90_days":5,"last_365_days":7},"latest":[{"cve":"CVE-2026-50157","cvss":6.5,"epss":0.0051,"slug":"cve-2026-50157-auth0-symfony-sdk-sensitive-information-exposure-via-url-query","title":"Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() an","severity":"medium","exploited":false,"published_at":"2026-09-14T18:17:49.663+00:00","url":"https://junglewise.ai/threats/cve-2026-50157-auth0-symfony-sdk-sensitive-information-exposure-via-url-query"},{"cve":"CVE-2026-85983","cvss":7.8,"epss":0.002,"slug":"cve-2026-85983-auth0-ad-ldap-connector-improper-configuration-processing-in-code","title":"Auth0 AD/LDAP Connector improper configuration processing in code injection","severity":"high","exploited":false,"published_at":"2026-09-08T21:18:47.407+00:00","url":"https://junglewise.ai/threats/cve-2026-85983-auth0-ad-ldap-connector-improper-configuration-processing-in-code"},{"cve":"CVE-2026-85982","cvss":9,"epss":0.004,"slug":"cve-2026-85982-auth0-ad-ldap-connector-stored-xss-in-admin-panel","title":"Auth0 AD/LDAP Connector stored XSS in admin panel","severity":"critical","exploited":false,"published_at":"2026-09-08T21:18:47.293+00:00","url":"https://junglewise.ai/threats/cve-2026-85982-auth0-ad-ldap-connector-stored-xss-in-admin-panel"},{"cve":"CVE-2026-85981","cvss":6.7,"epss":0.0019,"slug":"cve-2026-85981-auth0-ad-ldap-connector-unauthenticated-admin-panel","title":"Auth0 AD/LDAP Connector unauthenticated admin panel","severity":"medium","exploited":false,"published_at":"2026-09-08T21:18:47.173+00:00","url":"https://junglewise.ai/threats/cve-2026-85981-auth0-ad-ldap-connector-unauthenticated-admin-panel"},{"cve":"CVE-2026-84685","cvss":6.5,"epss":0.0028,"slug":"cve-2026-84685-auth0-react-native-auth0-improper-cache-isolation-in-web-platform","title":"Auth0 react-native-auth0 improper cache isolation in web platform","severity":"medium","exploited":false,"published_at":"2026-09-08T21:18:46.973+00:00","url":"https://junglewise.ai/threats/cve-2026-84685-auth0-react-native-auth0-improper-cache-isolation-in-web-platform"},{"cve":"CVE-2025-67716","cvss":3.1,"epss":0.0026,"slug":"cve-2025-67716-auth0-next-js-sdk-improper-query-parameter-validation","title":"Auth0 Next.js SDK improper query parameter validation","severity":"low","exploited":false,"published_at":"2025-12-10T21:35:58+00:00","url":"https://junglewise.ai/threats/cve-2025-67716-auth0-next-js-sdk-improper-query-parameter-validation"},{"cve":"CVE-2025-65945","cvss":7.5,"epss":0.0022,"slug":"cve-2025-65945-auth0-node-jws-signature-verification-bypass-in-hs256-algorithm","title":"Auth0 node-jws signature verification bypass in HS256 algorithm","severity":"high","exploited":false,"published_at":"2025-12-04T19:16:05.55+00:00","url":"https://junglewise.ai/threats/cve-2025-65945-auth0-node-jws-signature-verification-bypass-in-hs256-algorithm"},{"cve":"CVE-2025-48947","cvss":4,"epss":0.0043,"slug":"cve-2025-48947-auth0-nextjs-auth0-sdk-cdn-caching-of-session-cookies","title":"Auth0 NextJS-Auth0 SDK CDN caching of session cookies","severity":"medium","exploited":false,"published_at":"2025-06-04T21:24:52+00:00","url":"https://junglewise.ai/threats/cve-2025-48947-auth0-nextjs-auth0-sdk-cdn-caching-of-session-cookies"},{"cve":"CVE-2025-46344","cvss":4,"epss":0.0041,"slug":"cve-2025-46344-auth0-nextjs-sdk-missing-session-invalidation","title":"Auth0 NextJS SDK missing session invalidation","severity":"medium","exploited":false,"published_at":"2025-04-29T18:54:49+00:00","url":"https://junglewise.ai/threats/cve-2025-46344-auth0-nextjs-sdk-missing-session-invalidation"},{"cve":"CVE-2022-29172","cvss":3.1,"epss":0.0062,"slug":"cve-2022-29172-auth0-lock-cross-site-scripting-via-additional-signup-fields","title":"Auth0 Lock cross-site scripting via additional signup fields","severity":"low","exploited":false,"published_at":"2022-05-24T20:49:20+00:00","url":"https://junglewise.ai/threats/cve-2022-29172-auth0-lock-cross-site-scripting-via-additional-signup-fields"},{"cve":"CVE-2021-43812","cvss":3.1,"slug":"cve-2021-43812-auth0-nextjs-auth0-open-redirect-in-login-handler","title":"Auth0 nextjs-auth0 open redirect in login handler","severity":"low","exploited":false,"published_at":"2021-12-16T18:52:21+00:00","url":"https://junglewise.ai/threats/cve-2021-43812-auth0-nextjs-auth0-open-redirect-in-login-handler"},{"cve":"CVE-2021-32702","cvss":3.1,"epss":0.014,"slug":"cve-2021-32702-auth0-nextjs-auth0-reflected-xss-in-callback-handler","title":"Auth0 nextjs-auth0 reflected XSS in callback handler","severity":"low","exploited":false,"published_at":"2021-06-28T16:46:41+00:00","url":"https://junglewise.ai/threats/cve-2021-32702-auth0-nextjs-auth0-reflected-xss-in-callback-handler"},{"cve":"CVE-2021-32641","cvss":3.1,"epss":0.0154,"slug":"cve-2021-32641-auth0-lock-reflected-xss-in-flashmessages-and-languagedictionary","title":"Auth0 Lock reflected XSS in flashMessages and languageDictionary","severity":"low","exploited":false,"published_at":"2021-06-04T19:10:34+00:00","url":"https://junglewise.ai/threats/cve-2021-32641-auth0-lock-reflected-xss-in-flashmessages-and-languagedictionary"},{"cve":"CVE-2020-15125","cvss":3.1,"epss":0.0154,"slug":"cve-2020-15125-auth0-node-auth0-authorization-header-information-disclosure-in","title":"Auth0 node-auth0 authorization header information disclosure in error logging","severity":"low","exploited":false,"published_at":"2020-07-29T16:26:22+00:00","url":"https://junglewise.ai/threats/cve-2020-15125-auth0-node-auth0-authorization-header-information-disclosure-in"},{"cve":"CVE-2019-20174","cvss":3.1,"epss":0.0072,"slug":"cve-2019-20174-auth0-lock-xss-in-unsanitized-placeholder-property","title":"Auth0 Lock XSS in unsanitized placeholder property","severity":"low","exploited":false,"published_at":"2020-01-31T17:59:51+00:00","url":"https://junglewise.ai/threats/cve-2019-20174-auth0-lock-xss-in-unsanitized-placeholder-property"}],"vendor":{"hub":true,"name":"Auth0","slug":"auth0","homepage":"https://auth0.com/","description":"An adaptable authentication and authorization platform.","url":"https://junglewise.ai/threats/vendors/auth0"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":1,"exploited":0,"vulnerabilities":4},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-85982","cvss":9,"epss":0.004,"slug":"cve-2026-85982-auth0-ad-ldap-connector-stored-xss-in-admin-panel","title":"Auth0 AD/LDAP Connector stored XSS in admin panel","severity":"critical","exploited":false,"published_at":"2026-09-08T21:18:47.293+00:00","url":"https://junglewise.ai/threats/cve-2026-85982-auth0-ad-ldap-connector-stored-xss-in-admin-panel"},{"cve":"CVE-2026-85983","cvss":7.8,"epss":0.002,"slug":"cve-2026-85983-auth0-ad-ldap-connector-improper-configuration-processing-in-code","title":"Auth0 AD/LDAP Connector improper configuration processing in code injection","severity":"high","exploited":false,"published_at":"2026-09-08T21:18:47.407+00:00","url":"https://junglewise.ai/threats/cve-2026-85983-auth0-ad-ldap-connector-improper-configuration-processing-in-code"},{"cve":"CVE-2025-65945","cvss":7.5,"epss":0.0022,"slug":"cve-2025-65945-auth0-node-jws-signature-verification-bypass-in-hs256-algorithm","title":"Auth0 node-jws signature verification bypass in HS256 algorithm","severity":"high","exploited":false,"published_at":"2025-12-04T19:16:05.55+00:00","url":"https://junglewise.ai/threats/cve-2025-65945-auth0-node-jws-signature-verification-bypass-in-hs256-algorithm"},{"cve":"CVE-2026-85981","cvss":6.7,"epss":0.0019,"slug":"cve-2026-85981-auth0-ad-ldap-connector-unauthenticated-admin-panel","title":"Auth0 AD/LDAP Connector unauthenticated admin panel","severity":"medium","exploited":false,"published_at":"2026-09-08T21:18:47.173+00:00","url":"https://junglewise.ai/threats/cve-2026-85981-auth0-ad-ldap-connector-unauthenticated-admin-panel"},{"cve":"CVE-2026-50157","cvss":6.5,"epss":0.0051,"slug":"cve-2026-50157-auth0-symfony-sdk-sensitive-information-exposure-via-url-query","title":"Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() an","severity":"medium","exploited":false,"published_at":"2026-09-14T18:17:49.663+00:00","url":"https://junglewise.ai/threats/cve-2026-50157-auth0-symfony-sdk-sensitive-information-exposure-via-url-query"},{"cve":"CVE-2026-84685","cvss":6.5,"epss":0.0028,"slug":"cve-2026-84685-auth0-react-native-auth0-improper-cache-isolation-in-web-platform","title":"Auth0 react-native-auth0 improper cache isolation in web platform","severity":"medium","exploited":false,"published_at":"2026-09-08T21:18:46.973+00:00","url":"https://junglewise.ai/threats/cve-2026-84685-auth0-react-native-auth0-improper-cache-isolation-in-web-platform"},{"cve":"CVE-2025-48947","cvss":4,"epss":0.0043,"slug":"cve-2025-48947-auth0-nextjs-auth0-sdk-cdn-caching-of-session-cookies","title":"Auth0 NextJS-Auth0 SDK CDN caching of session cookies","severity":"medium","exploited":false,"published_at":"2025-06-04T21:24:52+00:00","url":"https://junglewise.ai/threats/cve-2025-48947-auth0-nextjs-auth0-sdk-cdn-caching-of-session-cookies"},{"cve":"CVE-2025-46344","cvss":4,"epss":0.0041,"slug":"cve-2025-46344-auth0-nextjs-sdk-missing-session-invalidation","title":"Auth0 NextJS SDK missing session invalidation","severity":"medium","exploited":false,"published_at":"2025-04-29T18:54:49+00:00","url":"https://junglewise.ai/threats/cve-2025-46344-auth0-nextjs-sdk-missing-session-invalidation"},{"cve":"CVE-2021-32641","cvss":3.1,"epss":0.0154,"slug":"cve-2021-32641-auth0-lock-reflected-xss-in-flashmessages-and-languagedictionary","title":"Auth0 Lock reflected XSS in flashMessages and languageDictionary","severity":"low","exploited":false,"published_at":"2021-06-04T19:10:34+00:00","url":"https://junglewise.ai/threats/cve-2021-32641-auth0-lock-reflected-xss-in-flashmessages-and-languagedictionary"},{"cve":"CVE-2020-15125","cvss":3.1,"epss":0.0154,"slug":"cve-2020-15125-auth0-node-auth0-authorization-header-information-disclosure-in","title":"Auth0 node-auth0 authorization header information disclosure in error logging","severity":"low","exploited":false,"published_at":"2020-07-29T16:26:22+00:00","url":"https://junglewise.ai/threats/cve-2020-15125-auth0-node-auth0-authorization-header-information-disclosure-in"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[{"name":"Auth0 AD/LDAP Connector","slug":"ad-ldap-connector","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/ad-ldap-connector"},{"name":"Auth0 Lock","slug":"lock","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/lock"},{"name":"Auth0 Nextjs-Auth0","slug":"nextjs-auth0","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/nextjs-auth0"}]}