Description
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Auth0 | auth0-lock | 10.9.0 – < 13.2.1, 14.0.0 – < 15.0.2 | 13.2.1 |