Skip to content
OpenAdvisories

Vendor

auth0

44 known vulnerabilities.

Products

nextjs-auth0 8 auth0-PHP 4 lock 3 auth0.js 3 passport-wsfed-saml2 3 node-jsonwebtoken 3 Auth0 AD/LDAP Connector 3 express-openid-connect 2 auth0-lock 1 symfony 1 node-auth0 1 express-jwt 1 ad-ldap-connector 1 omniauth-auth0 1 react-native-auth0 1 Login by Auth0 1 Auth0 ASP.NET Core Authentication 1 Auth0 Node JS 1 auth0-ai-llamaindex 1 auth0-ai-langchain 1 Auth0 AI JS 1 java-jwt 1 laravel-auth0 1 node-jws 1
All Critical High Medium Low Exploited only Public exploit

44 results · Feed

  • Medium 6.4
    CVE-2020-15119

    DOM-based XSS in auth0-lock

    In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.

    auth0 lock auth0-lock npm
  • High 7.7
    CVE-2020-15125

    Authorization header is not sanitized in an error object in auth0

    In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header …

    auth0 node-auth0 auth0 npm
  • High 7.7
    CVE-2020-15084

    Authorization bypass in express-jwt

    In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization…

    auth0 express-jwt express-jwt npm
  • Medium 5.5
    CVE-2020-5263

    Information disclosure through error object

    auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plain…

    auth0 auth0.js auth0-js npm