[ CVE-2026-107370 · Published 13 Oct 2026 ]
Vulnerability in auth0-lock
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.