Auth0 vulnerabilities
We track 14 vulnerabilities in Auth0 products across 11 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on September 8, 2026.
Latest Auth0 vulnerabilities
- 7.8 High severity
Auth0 AD/LDAP Connector: Improper Control of Generation of Code
The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code
- 9.0 Critical severity
Auth0 AD/LDAP Connector: Improper Neutralization of Input During Web Page Generation
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attrib
- 7.1 High severity
auth0.js: Incorrect Authorization
Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. Th
- 9.8 Critical severity
auth0-PHP: Insufficient Entropy
Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the
- 7.5 High severity
auth0-PHP: Incorrect Authorization
Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access
- 7.5 High severity
node-jws: Improper Verification of Cryptographic Signature
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are a
- 7.7 High severity
nextjs-auth0: Use of Web Browser Cache Containing Sensitive Information
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session` cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three pr
- 9.3 Critical severity
auth0-PHP: Deserialization of Untrusted Data
Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a thr
- 9.1 Critical severity
auth0-PHP: Improper Authentication
Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be b
- 8.6 High severity
passport-wsfed-saml2: Improper Authentication
passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by tampering with a va
- 9.3 Critical severity
passport-wsfed-saml2: Improper Authentication
passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResp
- 8.1 High severity
node-jsonwebtoken: Use of a Broken or Risky Cryptographic Algorithm
Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key t
- 7.6 High severity
node-jsonwebtoken: Improper Verification of Cryptographic Signature
In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify
- 7.5 High severity
passport-wsfed-saml2: Improper Authentication
Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requir