auth0 Latest High & Critical Vulnerabilities

Latest High & Critical vulnerabilities published by auth0

JSON RSS CSV 🔔 Create Alert Trigger

4 December 2025

Improper Signature Verification in Node.js JSON Web Signature Implementation by Auth0
CVE-2025-65945
Auth0Node-jws👾🟡7.5HIGH

4 June 2025

Session Cookie Vulnerability in Auth0 Next.js SDK for User Authentication
CVE-2025-48947
Auth0Nextjs-auth07.7HIGH

6 May 2025

SAML Authentication Vulnerability in Passport-WSFED-SAML2 by Auth0
CVE-2025-46573
Auth0Passport-wsfed-saml28.6HIGH
SAML Authentication Vulnerability in Auth0's Passport Strategy for WS-fed and SAML2
CVE-2025-46572
Auth0Passport-wsfed-saml29.3CRITICAL

22 December 2022

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()
CVE-2022-23540
Auth0Node-jsonwebtoken7.6HIGH

31 March 2022

Open Redirect in express-openid-connect
CVE-2022-24794
Auth0Express-openid-connect7.5HIGH

25 June 2021

Reflected XSS from the callback handler's error query parameter
CVE-2021-32702
Auth0Nextjs-auth08HIGH

4 June 2021

Reflected XSS when using flashMessages
CVE-2021-32641
Auth0Lock8.1HIGH

6 November 2020

CSRF in Auth0 ad-ldap-connector
CVE-2020-15259
Auth0Ad-ldap-connector8.1HIGH

21 October 2020

Regression in JWT Signature Validation
CVE-2020-15240
Auth0Omniauth-auth07.4HIGH

29 July 2020

Authorization header is not sanitized in an error object in auth0
CVE-2020-15125
Auth0Node-auth07.7HIGH

30 June 2020

Authorization bypass in express-jwt
CVE-2020-15084
Auth0Express-jwt7.7HIGH

8 October 2019

Incorrect Access Control in Auth0 IdentityTokenValidator
CVE-2019-16929
Auth0Auth0.net7.5HIGH

25 July 2019

Authentication Bypass in Auth0 Passport-SharePoint by Auth0
CVE-2019-13483
Auth0Passport-sharepoint7.3HIGH

11 April 2019

JWT Signature Leak Vulnerability in Auth0 WCF Service
CVE-2019-7644
Auth0Auth0-wcf-service-jwt9.8CRITICAL

29 August 2018

CSRF Vulnerability in Auth0 ASP.NET Packages
CVE-2018-15121
Auth0Aspnet-owin8.8HIGH

4 April 2018

6 March 2018

Cross-Site Request Forgery Vulnerability in Auth0.js Library by Auth0
CVE-2018-7307
Auth0Auth0.js8.8HIGH

27 December 2017

User Impersonation Vulnerability in Auth0 Passport-WSFED-SAML2 Library
CVE-2017-16897
Auth0Passport-wsfed-saml28.1HIGH

6 December 2017

Cross-Origin Vulnerability in Auth0.js Library Affecting Auth0
CVE-2017-17068
Auth0Auth0.js7.5HIGH