Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-126129

The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to

Description

The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Auth0 Auth0 ASP.NET Core Authentication

Default version status: unaffected

  • 0 to < 1.12.0affected

References