Auth0 Auth0-lock vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Auth0 Auth0-lock: 1 record(s), with affected versions and fixes.
CVE-2026-107370
Medium · 5.3
CWE-532 Oct 13, 2026
Improper Request Handling for Active Directory Logins in auth0-lock
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.