{"id":"CVE-2026-126129","state":"PUBLISHED","title":"The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to ","description":"The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.","publishedAt":"2026-11-10T21:14:09.582Z","updatedAt":"2026-11-10T21:14:09.582Z","severity":null,"assigner":"Okta","products":["Auth0 Auth0 ASP.NET Core Authentication"],"affected":[{"vendor":"Auth0","product":"Auth0 ASP.NET Core Authentication","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.12.0","versionType":"semver"}]}],"references":["https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129"],"weaknesses":["CWE-807","CWE-287","CWE-1254"],"ingestedAt":"2026-11-10T21:20:06.790Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/126xxx/CVE-2026-126129.json","commit":"4a945ab985cc9fd1577a040fa24bce4f8959cb79","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-126129","state":"PUBLISHED","datePublished":"2026-11-10T21:14:09.582Z","dateUpdated":"2026-11-10T21:14:09.582Z","assignerShortName":"Okta","assignerOrgId":"59b22baa-87b2-4371-8e4a-e080df12f74a","dateReserved":"2026-11-10T18:52:30.790Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints."}],"affected":[{"vendor":"Auth0","product":"Auth0 ASP.NET Core Authentication","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.12.0","versionType":"semver"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-807","lang":"en","description":"CWE-807: Reliance on Untrusted Inputs in a Security Decision","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-287","lang":"en","description":"CWE-287: Improper Authentication","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-1254","lang":"en","description":"CWE-1254: Incorrect Comparison Logic Granularity","type":"CWE"}]}],"providerMetadata":{"shortName":"Okta","orgId":"59b22baa-87b2-4371-8e4a-e080df12f74a","dateUpdated":"2026-11-10T21:14:09.582Z"},"x_generator":{"engine":"cvelib 1.8.0"}}}}}