Vulnerabilidades do Auth0 Auth0 AD/LDAP Connector
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Auth0 Auth0 AD/LDAP Connector: 3 registro(s), com versões afetadas e correções.
CVE-2026-85983
Alta · 7.8
CWE-94 08/09/2026
Local Privilege Escalation in Auth0 AD/LDAP Connector
The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.
CVE-2026-85982
Crítica · 9.0
CWE-79 08/09/2026
Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs.
CVE-2026-85981
Média · 6.7
CWE-306 08/09/2026
Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector
The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings.