auth0-lock vulnerabilities

CVEs whose affected-version data names the auth0-lock package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-107370Medium· 5.3

2w ago

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is a…

▾ SunlitAuth0 · auth0-lockEPSS 0.28%via NVD