Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-107370

Improper Request Handling for Active Directory Logins in auth0-lock

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Okta

Description

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Auth0 auth0-lock

Default version status: unaffected

  • 10.9.0 to < 13.2.1affected
  • 14.0.0 to < 15.0.2affected

References