CVE-2019-20174: Improper Neutralization of Input During Web Page Generation

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

@brudi-toolbox/id (>=1.4.5-next.1, <=1.11.4-next.7), @cimpress/simple-auth-wrapper (>=3.0.0, <=3.1.6) +4 more potentially affected by CVE-2019-20174 via auth0-lock (>=11.0.1, <=11.20.4)

auth0-lock NPM version =11.0.1, =1.4.5-next.1, =3.0.0, =0.0.1, =1.0.42, =0.11.0, =0.17.1 Source cves: CVE-2019-20174 Source advisory: OSV:GHSA-W2PF-G6R8-PG22...

Cross-Site Request Forgery (CSRF)

Auth0 and Auth0-lock is vulnerable to cross-site request forgery. The vulnerability exists when the Legacy Lock API flag is enabled. This allows an attacker to perform unwanted actions in the context of the user when the victim is tricked into visiting a malicious web page...

Multiple Auth0 Library Authentication Bypass Vulnerabilities

Auth0.js is a client-side library for Auth0, and Lock is an embeddable login form for desktops, tablets, and mobile devices. An authentication bypass vulnerability exists in Auth0 Lock 10 and auth0.js 8, which can be exploited by an attacker to log in as an administrator, perform administrative...

Multiple Auth0 Library Cross-Site Request Forgery Vulnerabilities

Auth0.js is a client-side library for Auth0, and Lock is an embeddable login form for desktops, tablets, and mobile devices. A cross-site request forgery vulnerability exists in Auth0 Lock 10 and auth0.js 8, which can be exploited by a remote attacker constructing a malicious website to perform...