Skip to content

Product

auth0 lock vulnerabilities

4 published CVES affecting auth0 lock, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
0
High
0
Medium
4
Low
0
Unscored
0
CISA KEV
0

Latest auth0 lock CVEs

Newest publication first

  1. CVE-2022-29172 HTML injection with additional signup fields

    Published
    MediumCVSS 6.1 EPSS 0.62%

    Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before 11.33.0, when the “additional signup fields” feature is configured, a malicious actor can inject invali...

  2. CVE-2021-32641 Reflected XSS when using flashMessages

    Published
    MediumCVSS 6.1 EPSS 1.5%

    auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's flashMessage feature is utilized and user input or data from URL parameters is incorporated into...

  3. CVE-2020-15119 DOM-based XSS in auth0-lock

    Published
    MediumCVSS 5.4 EPSS 0.55%

    In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.