Skip to content
OpenAdvisories

Product · auth0

auth0-lock

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-107370

    Improper Request Handling for Active Directory Logins in auth0-lock

    When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as …

    auth0 auth0-lock