CVE-2021-32702

The CVE-2021-32702 entry concerns the Auth0 Next.js SDK (@auth0/nextjs-auth0). Affected versions are 1.4.1 and earlier, vulnerable to reflected XSS via an error query parameter processed by the callback handler. The exploit is a reflected XSS that can execute arbitrary code when the error message...

CVE-2021-32702 Reflected XSS from the callback handler's error query parameter

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

Cross-site Scripting

nextjs-auth0 lacks HTML escaping for error messages...

Auth0 跨站脚本漏洞

Auth0 is is an authentication agent that supports social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. The Auth0 Next.js SDK suffers from a cross-site scripting vulnerability that stems from the vulnerability to reflected XSS in versions 1.4.1 a...

Auth0 Cross-Site Scripting Vulnerability

Auth0 is is an authentication agent that supports social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. Auth0-lock suffers from a cross-site scripting vulnerability in versions prior to 11.30.0 that can be exploited by an attacker to execute...

Cross-Site Scripting (XSS)

auth0-lock is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via the flashMessage feature or languageDictionary feature...

CVE-2021-32641

auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage ...

CVE-2021-32641

auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage ...

Design/Logic Flaw

auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage ...

CVE-2021-32641

CVE-2021-32641 affects Auth0-lock (Auth0’s signin solution). Versions up to and including 11.30.0 are vulnerable to a reflected XSS when user input from URL parameters is injected into the library’s flashMessage or languageDictionary features. The issue is addressed in version 11.30.1, which patc...

CVE-2021-32641 Reflected XSS when using flashMessages

auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage ...

Reflected Cross-Site Scripting

Overview There is an XSS vulnerability in affected versions of auth0-lock. Overview Versions before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's - flashMessage feature is utilized and user input or data from URL parameters is...

Reflected XSS when using flashMessages or languageDictionary

Overview Versions before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's - flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage. - languageDictionary feature is utilized a...

@apim/auth0-lock-redux (>=1.0.0 <=1.0.2), @brudi-toolbox/id (>=1.4.5-next.1 <=2.0.4-next.2) +36 more potentially affected by CVE-2021-32641 via auth0-lock (>=10.14.0 <=11.28.1)

auth0-lock NPM version =10.14.0, =1.0.0, =1.4.5-next.1, =2.2.0, =1.0.0, =0.1.0, =0.3.0, =0.0.1, =1.0.0, =0.1.0, =0.5.3, =0.1.13, =1.0.0, =0.0.1, =0.0.5 - auth0-react-sample =1.0.0 and more Source cves: CVE-2021-32641 Source advisory: OSV:GHSA-JR3J-WHM4-9WWM...

Auth0 跨站脚本漏洞

Auth0 is is an authentication agent that supports social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. Auth0-lock suffers from a cross-site scripting vulnerability in versions prior to 11.30.0 that can be exploited by an attacker to execute...

Regression in JWT Signature Validation

Overview Versions after and including 2.3.0 are improperly validating the JWT token signature when using the JWTValidator.verify method. Improper validation of the JWT token signature when not using the default Authorization Code Flow can allow an attacker to bypass authentication and...

GHSA-58R4-H6V8-JCVM Regression in JWT Signature Validation

Overview Versions after and including 2.3.0 are improperly validating the JWT token signature when using the JWTValidator.verify method. Improper validation of the JWT token signature when not using the default Authorization Code Flow can allow an attacker to bypass authentication and...

Regression in JWT Signature Validation

Overview Versions after and including 2.3.0 are improperly validating the JWT token signature when using the JWTValidator.verify method. Improper validation of the JWT token signature when not using the default Authorization Code Flow can allow an attacker to bypass authentication and...

Regression in JWT Signature Validation

Overview Affected versions of this package are vulnerable to Regression in JWT Signature Validation. It improperly validates the JWT token signature when using the jwtvalidator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and...

Authorization Bypass

omniauth-auth0 is vulnerable to authorization bypass. The vulnerability exists through a regression made in code that validates JWT token signatures, where it is possible to bypass authentication and authorization when the default Authorization Code Flow is not used...