auth0 has 13 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 9 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 5. The median CVSS is 6.5 (medium), with 1 rated critical. None have a confirmed exploitation report. Most affected products: Auth0 AD/LDAP Connector (3), nextjs-auth0 (3), auth0-lock (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 9 prev 0
Products
- Auth0 AD/LDAP Connector 3
- nextjs-auth0 3
- auth0-lock 1
- auth0-php 1
- auth0.js 1
- java-jwt 1
Worst active — by depth score
CVE-2025-65945High· 7.5auth0/node-jws is a JSON Web Signature implementation for Node.js53CVE-2026-85982Critical· 9.0The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel50CVE-2026-85983High· 7.8The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup43CVE-2026-85981Medium· 6.7The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication37CVE-2025-68129Medium· 6.8Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs37
auth0 vulnerabilities
CVEs affecting auth0, newest first. Open any entry for full detail, references, and exploit status.
13 CVEsRSS
CVE-2026-85473Medium· 5.3The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value
The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests…
CVE-2026-107371Medium· 5.4When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value
When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token t…
CVE-2026-107370Medium· 5.3When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is a…
CVE-2026-107369Medium· 6.1The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL …
CVE-2026-50157Medium· 6.5Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs
Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bear…
CVE-2026-85983High· 7.8The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup
The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configur…
CVE-2026-85982Critical· 9.0The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to …
CVE-2026-85981Medium· 6.7The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication
The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to acce…
CVE-2026-84685Medium· 6.5The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. U…
CVE-2025-68129Medium· 6.8Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs
Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may acc…
CVE-2025-67716Medium· 5.7The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended O…
CVE-2025-67490Medium· 5.4The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRe…
CVE-2025-65945High· 7.5PoCauth0/node-jws is a JSON Web Signature implementation for Node.js
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditi…