Auth0 CVEs
23 vulnerabilities mapped to Auth0’s software or packages, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-85473 Out-of-Range Timestamp Claim Handling in auth0/java-jwt
CVSS 5.3 mediumEPSS 0.32%
CVE-2026-107371 Missing Verification of auth_time Claim in auth0.js
CVSS 5.4 mediumEPSS 0.21%
CVE-2026-107370 Improper Request Handling for Active Directory Logins in auth0-lock
CVSS 5.3 mediumEPSS 0.28%
CVE-2026-107369 Improper Validation of Post-Login Redirect URL in nextjs-auth0
CVSS 6.1 mediumEPSS 0.22%
CVE-2026-50157 Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK
CVSS 6.5 mediumEPSS 0.51%
CVE-2026-85983 Local Privilege Escalation in Auth0 AD/LDAP Connector
CVSS 7.8 highEPSS 0.20%
CVE-2026-85982 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
CVSS 9.0 criticalEPSS 0.40%
CVE-2026-85981 Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector
CVSS 6.7 mediumEPSS 0.19%
CVE-2026-42280 Improper Permission Checking in Auth.js SDK
CVSS 7.1 highEPSS 0.21%
CVE-2026-40155 Auth0 Next.js SDK has Improper Proxy Cache Lookup
CVSS 5.4 mediumEPSS 0.21%
CVE-2026-34236 Auth0 PHP SDK Insufficient Entropy in Cookie Encryption
CVSS 8.2 highEPSS 0.22%
CVE-2025-68129 Auth0-PHP SDK has Improper Audience Validation
CVSS 6.8 mediumEPSS 0.43%
CVE-2025-67716 Auth0 Next.js SDK has Improper Validation of Query Parameters
CVSS 5.7 mediumEPSS 0.26%
CVE-2025-67490 Auth0 Next.js SDK has Improper Request Caching Lookup
CVSS 5.4 mediumEPSS 0.20%
CVE-2025-65945 auth0/node-jws improper HMAC signature verification vulnerability
CVSS 7.5 highEPSS 0.22%
CVE-2025-58769 auth0-PHP: Improper File Type Handling in Bulk User Import
CVSS 3.3 lowEPSS 0.35%
CVE-2025-48947 NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies
CVSS 7.7 highEPSS 0.43%
CVE-2025-48951 Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
CVSS 9.3 criticalEPSS 0.75%
CVE-2025-47275 Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
CVSS 9.1 criticalEPSS 0.54%
CVE-2025-46573 passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smuggling
CVSS 8.6 highEPSS 0.37%
CVE-2025-46572 passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrapping
CVSS 9.3 criticalEPSS 0.42%
CVE-2025-46344 Auth0 NextJS SDK v4 Missing Session Invalidation
CVSS 4.9 mediumEPSS 0.43%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)