Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
auth0 vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv2
CVE-2018-6873
The Auth0 authentication service prior to 2017-10-15 allows privilege escalation because the JWT audience is not validated.
Auth0 Auth0.js
6.8
CVSSv2
CVE-2018-6874
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
Auth0 Auth0.js
4.3
CVSSv2
CVE-2020-6753
The Login by Auth0 plugin prior to 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.
Auth0 Login By Auth0
4.3
CVSSv2
CVE-2019-20173
The Auth0 wp-auth0 plugin 3.11.x prior to 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.
Auth0 Login By Auth0
6.5
CVSSv2
CVE-2020-7948
An issue exists in the Login by Auth0 plugin prior to 4.0.0 for WordPress. A user can perform an insecure direct object reference.
Auth0 Login By Auth0
7.5
CVSSv2
CVE-2020-7947
An issue exists in the Login by Auth0 plugin prior to 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of ...
Auth0 Login By Auth0
7.5
CVSSv2
CVE-2019-7644
Auth0 Auth0-WCF-Service-JWT prior to 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable...
Auth0 Auth0-wcf-service-jwt
6.8
CVSSv2
CVE-2018-15121
An issue exists in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.
Auth0 Aspnet-owin -
Auth0 Aspnet -
NA
CVE-2022-23540
In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the...
Auth0 Jsonwebtoken
NA
CVE-2022-23541
jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect veri...
Auth0 Jsonwebtoken
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
SSTI
CVE-2024-35863
CVE-2024-35910
man-in-the-middle
CVE-2024-35912
CVE-2024-25742
LFI
CVE-2024-32002
CVE-2024-22120
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
NEXT »