Stored Cross-Site Scripting Vulnerability in Auth0 AD/LDAP Connector

CVE-2026-85982

What is CVE-2026-85982?

The Auth0 AD/LDAP Connector is susceptible to stored Cross-Site Scripting (XSS) vulnerabilities. This arises from inadequate HTML encoding of data within search results and updater log content that is presented in the admin panel. An authenticated user possessing the rights to amend directory attributes, or even a low-privileged local user on the system hosting the connector, can embed malicious script content. If an administrator subsequently views the compromised search results or update logs, the injected script may execute in their browser, posing a significant threat to the application's integrity and the security of its users.

References