CVEs for Auth0
23 matching vulnerabilities, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-50157 Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK
CVSS 6.5 mediumEPSS 0.51%Auth0
CVE-2026-42280 Improper Permission Checking in Auth.js SDK
CVSS 7.1 highEPSS 0.21%Auth0
CVE-2026-40155 Auth0 Next.js SDK has Improper Proxy Cache Lookup
CVSS 5.4 mediumEPSS 0.21%Auth0
CVE-2026-34236 Auth0 PHP SDK Insufficient Entropy in Cookie Encryption
CVSS 8.2 highEPSS 0.22%Auth0
CVE-2025-68129 Auth0-PHP SDK has Improper Audience Validation
CVSS 6.8 mediumEPSS 0.43%Auth0
CVE-2025-67716 Auth0 Next.js SDK has Improper Validation of Query Parameters
CVSS 5.7 mediumEPSS 0.26%Auth0
CVE-2025-67490 Auth0 Next.js SDK has Improper Request Caching Lookup
CVSS 5.4 mediumEPSS 0.20%Auth0
CVE-2025-65945 auth0/node-jws improper HMAC signature verification vulnerability
CVSS 7.5 highEPSS 0.22%Auth0
CVE-2025-58769 auth0-PHP: Improper File Type Handling in Bulk User Import
CVSS 3.3 lowEPSS 0.35%Auth0
CVE-2025-48947 NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies
CVSS 7.7 highEPSS 0.43%Auth0
CVE-2025-48951 Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
CVSS 9.3 criticalEPSS 0.75%Auth0
CVE-2025-47275 Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
CVSS 9.1 criticalEPSS 0.54%Auth0
CVE-2025-46573 passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smuggling
CVSS 8.6 highEPSS 0.37%Auth0
CVE-2025-46572 passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrapping
CVSS 9.3 criticalEPSS 0.42%Auth0
CVE-2025-46344 Auth0 NextJS SDK v4 Missing Session Invalidation
CVSS 4.9 mediumEPSS 0.43%Auth0
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)