[ Vendor · 4 CVEs ]
Auth0
CVEs affecting Auth0 published in the last 30 days, plus any Auth0 CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-85473 | 13 Oct 2026 | CVSS 5.3 | Auth0 java-jwtThe auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The… | |
| CVE-2026-107369 | 13 Oct 2026 | CVSS 6.1 | Auth0 nextjs-auth0The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step… | |
| CVE-2026-107370 | 13 Oct 2026 | CVSS 5.3 | auth0-lockWhen a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction… | |
| CVE-2026-107371 | 13 Oct 2026 | CVSS 5.4 | auth0.jsWhen the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token… |