Description (CNA)
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Auth0 / auth0-lock | affected 10.9.0 before 13.2.1; affected 14.0.0 before 15.0.2 |
CWE
CWE-598, CWE-532
References
- https://trust.okta.com/security-advisories/improper-request-handling-for-active-directory-logins-in-auth0-lock-cve-2026-107370
- https://github.com/auth0/lock/security/advisories/GHSA-mp8m-wcxp-w648
ADP enrichment
No English description supplied.
No references supplied.