Skip to content
OpenAdvisories

Vendor

auth0

44 known vulnerabilities.

Products

nextjs-auth0 8 auth0-PHP 4 lock 3 auth0.js 3 passport-wsfed-saml2 3 node-jsonwebtoken 3 Auth0 AD/LDAP Connector 3 express-openid-connect 2 auth0-lock 1 symfony 1 node-auth0 1 express-jwt 1 ad-ldap-connector 1 omniauth-auth0 1 react-native-auth0 1 Login by Auth0 1 Auth0 ASP.NET Core Authentication 1 Auth0 Node JS 1 auth0-ai-llamaindex 1 auth0-ai-langchain 1 Auth0 AI JS 1 java-jwt 1 laravel-auth0 1 node-jws 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-85982

    Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector

    The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attri…

    auth0 Auth0 AD/LDAP Connector
  • Critical 9.3
    CVE-2025-48951

    Auth0-PHP SDK Deserialization of Untrusted Data vulnerability

    Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a th…

    auth0 auth0-PHP auth0/auth0-php Packagist
  • Critical 9.1
    CVE-2025-47275

    Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK

    Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be …

    auth0 auth0-PHP auth0/auth0-php Packagist
  • Critical 9.3
    CVE-2025-46572

    passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrapping

    passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by crafting a SAMLRes…

    auth0 passport-wsfed-saml2 passport-wsfed-saml2 npm