Log in Start free

Auth0

Products

ProductCVEsExploitedLatest
nextjs-auth08–Oct 13, 2026
auth0-PHP4–Apr 1, 2026
node-jsonwebtoken3–Dec 22, 2022
Auth0 AD/LDAP Connector3–Sep 8, 2026
passport-wsfed-saml23–May 6, 2025
lock3–May 5, 2022
auth0.js3–Oct 13, 2026
express-openid-connect2–Mar 31, 2022
omniauth-auth01–Oct 21, 2020
react-native-auth01–Sep 8, 2026
ad-ldap-connector1–Nov 6, 2020
symfony1–Sep 14, 2026
auth0-lock1–Oct 13, 2026
express-jwt1–Jun 30, 2020
java-jwt1–Oct 13, 2026
laravel-auth01–Oct 1, 2025
Login by Auth01–Jul 10, 2024
node-auth01–Jul 29, 2020
node-jws1–Dec 4, 2025

Exploited and recent CVEs

  • CVE-2026-85473 Medium 5.3 Out-of-Range Timestamp Claim Handling in auth0/java-jwt 0.3%
  • CVE-2026-107371 Medium 5.4 Missing Verification of auth_time Claim in auth0.js 0.2%
  • CVE-2026-107370 Medium 5.3 Improper Request Handling for Active Directory Logins in auth0-lock 0.3%
  • CVE-2026-107369 Medium 6.1 Improper Validation of Post-Login Redirect URL in nextjs-auth0 0.2%
  • CVE-2026-50157 Medium 6.5 Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK 0.5%
  • CVE-2026-84685 Medium 6.5 Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management 0.3%
  • CVE-2026-85983 High 7.8 Local Privilege Escalation in Auth0 AD/LDAP Connector 0.2%
  • CVE-2026-85982 Critical 9.0 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector 0.4%
  • CVE-2026-85981 Medium 6.7 Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector 0.2%
  • CVE-2026-42280 High 7.1 Improper Permission Checking in Auth.js SDK 0.2%
  • CVE-2026-40155 Medium 5.4 Auth0 Next.js SDK has Improper Proxy Cache Lookup 0.2%
  • CVE-2026-34236 High 8.2 Auth0 PHP SDK Insufficient Entropy in Cookie Encryption 0.2%
  • CVE-2025-68129 Medium 6.8 Auth0-PHP SDK has Improper Audience Validation 0.4%
  • CVE-2025-67716 Medium 5.7 Auth0 Next.js SDK has Improper Validation of Query Parameters 0.3%
  • CVE-2025-67490 Medium 5.4 Auth0 Next.js SDK has Improper Request Caching Lookup 0.2%
  • CVE-2025-65945 High 7.5 auth0/node-jws improper HMAC signature verification vulnerability 0.2%
  • CVE-2025-58769 Low 3.3 auth0-PHP: Improper File Type Handling in Bulk User Import 0.4%
  • CVE-2025-48947 High 7.7 NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies 0.4%
  • CVE-2025-48951 Critical 9.3 Auth0-PHP SDK Deserialization of Untrusted Data vulnerability 0.8%
  • CVE-2025-47275 Critical 9.1 Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK 0.5%
  • CVE-2025-46573 High 8.6 passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smuggling 0.4%
  • CVE-2025-46572 Critical 9.3 passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrapping 0.4%
  • CVE-2025-46344 Medium 4.9 Auth0 NextJS SDK v4 Missing Session Invalidation 0.4%
  • CVE-2023-6813 Medium 6.1 Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle 0.4%
  • CVE-2022-23539 Medium 5.9 jsonwebtoken unrestricted key type could lead to legacy keys usage 0.5%
  • CVE-2022-23540 Medium 6.4 jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() 0.6%
  • CVE-2022-23541 Medium 5.0 jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC 0.8%
  • CVE-2022-23505 Medium 5.3 Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication 0.8%
  • CVE-2022-29172 Medium 6.1 HTML injection with additional signup fields 0.6%
  • CVE-2022-24794 High 7.5 Open Redirect in express-openid-connect 0.7%