All vulnerabilities
CVE-2026-107370GHSA-mp8m-wcxp-w648

Improper Request Handling for Active Directory Logins in auth0-lock

Auth0 auth0-lock
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in13.2.1Also 15.0.2CVE List
Published13 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.

Text from CVE List

Affected versions 2

  • auth0-lockaffected: 10.9.0 before 13.2.1CVE List
  • auth0-lockaffected: 14.0.0 before 15.0.2CVE List

References 2