GHSA-QPVX-GPQM-G98J Critical severity vulnerability that affects Auth0-WCF-Service-JWT

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application...

CVE-2019-7644

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application...

CVE-2019-7644

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application...

Code injection

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application...

CVE-2019-7644

The CVE-2019-7644 entry concerns Auth0-WCF-Service-JWT prior to 1.0.4, where the service leaks the expected JWT signature in an error message when signature validation fails. This enables an attacker to forge arbitrary JWT tokens that the vulnerable application will accept, effectively bypassing ...

CVE-2019-7644

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application...

Information Disclosure

Auth0-WCF-Service-JWT is vulnerable to information disclosure. The JWT signature is revealed in an error message when the JWT signature validation fails, allowing attackers to abuse the erroneous behavior to obtain and forge valid signatures for arbitrary tokens and bypass authentication and...

Cross-Site Request Forgery (CSRF)

Auth0 and Auth0-lock is vulnerable to cross-site request forgery. The vulnerability exists when the Legacy Lock API flag is enabled. This allows an attacker to perform unwanted actions in the context of the user when the victim is tricked into visiting a malicious web page...

Privilege Escalation

Auth0 is vulnerable to privilege escalation. A lack of the JWT token and signature validation in the parseHash method allows a remote attacker to authenticate as another user with higher privileges...

GHSA-WV26-RJ8C-4R33 Cross-Site Request Forgery (CSRF) in Auth0

CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled...

Cross-Site Request Forgery (CSRF) in Auth0

CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled...

Replay Attack

auth0 is vulnerable to replay attacks. The authentication renew request does not include a nonce, which would allow an attacker to replay an old renewAuth request to obtain a valid session...

Cross site request forgery (csrf)

An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations...

CVE-2018-15121

An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations...

CVE-2018-15121

CVE-2018-15121 affects Auth0 ASP.NET and ASP.NET OWIN libraries, where the state parameter is not used or validated in OAuth 2.0/OpenID Connect flows. This omission enables CSRF during authentication/authorization. Connected sources corroborate the issue across multiple advisories (Snyk, OSV, GHS...

CVE-2018-15121

An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations...

Design/Logic Flaw

Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain...

CVE-2018-11537

Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain...

CVE-2018-11537

Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain...

CVE-2018-11537

Auth0 angular-jwt (before v0.1.10) is affected: entries in whiteListedDomains are treated as regular expressions, allowing a crafted domain to bypass the domain allowlist/whitelist filter. This misinterpretation can enable unauthorized access by crafting domains that match the regex pattern (e.g....