Skip to content
OpenAdvisories

Package · npm

auth0-lock

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 6.1
    CVE-2022-29172

    HTML injection with additional signup fields

    Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before `11.33.0`, when the “additional signup fields” feature [is configured](https://git…

    auth0 lock auth0-lock npm
  • High 8.1
    CVE-2021-32641

    Reflected XSS when using flashMessages

    auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's `flashMessage` feature is utilized and user input or data from URL paramet…

    auth0 lock auth0-lock npm
  • Medium 6.4
    CVE-2020-15119

    DOM-based XSS in auth0-lock

    In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.

    auth0 lock auth0-lock npm
  • Medium 6.1
    CVE-2019-20174

    auth0-lock vulnerable to XSS via unsanitized placeholder property

    Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.

    auth0-lock npm