Auth0 Lock vulnerabilities

1 vulnerability

Known vulnerabilities in Auth0 Lock, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3CVE-2026-107370auth0auth0-lock
EPSS score
0.28%
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.