@advancedalgos/key-vault-client (>=0.0.1, <=0.0.8), @advancedalgos/teams-client (>=0.0.1, <=0.0.32) +73 more potentially affected by CVE-2026-107370 via auth0-lock (>=10.14.0, <=12.5.1)

auth0-lock NPM version =10.14.0, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =0.0.1, =1.4.5-next.1, =0.0.1, =2.2.0, =1.0.0, =0.1.0, =0.3.0, =0.0.1, =2.0.0, =15.4.335 and more Source cves: CVE-2026-107370 Source advisory: SNYK:JS-AUTH0LOCK-20936889...

@ctx-core/auth0-lock (>=15.4.336, <=15.4.337) potentially affected by CVE-2026-107370 via auth0-lock (14.3.0)

auth0-lock NPM version 14.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on auth0-lock and may be impacted: - @ctx-core/auth0-lock =15.4.336, =15.4.337 Source cves: CVE-2026-107370 Source advisory: SNYK:JS-AUTH0LOCK-20936889...

CVE-2026-107370

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters...

CVE-2026-107370

The auth0-lock library is vulnerable to improper request handling during Active Directory logins. When a username consists of a domain without a local part, the library incorrectly initiates the authentication transaction using a GET request instead of a POST request. This causes sensitive user-s...

CVE-2026-107370 Improper Request Handling for Active Directory Logins in auth0-lock

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters...

CVE-2026-107370: Use of GET Request Method With Sensitive Query Strings

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters...

PT-2026-113366

🚨 CVE-2026-107370 When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string...

Malicious Package

Overview auth0-lock-webpack is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2019-20174

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

EUVD-2021-1348

Malware in sbrugna...

EUVD-2020-0601

Malware in sbrugna...

EUVD-2020-0280

Malware in sbrugna...

CVE-2020-15119

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...

MAL-2024-11818 Malicious code in auth0-lock-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc8cb7c85f580c66397adec583bbd6623eafcb98683fcf6299ca73188892009f The OpenSSF Package Analysis project identified 'auth0-lock-webpack' @ 99.99.99 npm as malicious. It is considered malicious because: - The...

Malicious code in auth0-lock-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc8cb7c85f580c66397adec583bbd6623eafcb98683fcf6299ca73188892009f The OpenSSF Package Analysis project identified 'auth0-lock-webpack' @ 99.99.99 npm as malicious. It is considered malicious because: - The...

Malicious code in auth0-lock-browserify (npm)

--- -= Per source details. Do not edit below this line.=-...

Cross-site Scripting in Auth0 Lock

Overview In versions before and including 11.32.2, when the “additional signup fields” feature is configured, a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service usermetdata payload using the name property. Verification emails, when...

GHSA-7WW6-75FJ-JCJ7 Cross-site Scripting in Auth0 Lock

Overview In versions before and including 11.32.2, when the “additional signup fields” feature is configured, a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service usermetdata payload using the name property. Verification emails, when...

@brudi-toolbox/id (>=1.4.5-next.1, <=2.0.4), @cimpress/simple-auth-wrapper (>=3.0.0, <=3.1.6) +6 more potentially affected by CVE-2022-29172 via auth0-lock (>=11.0.1, <=11.31.0)

auth0-lock NPM version =11.0.1, =1.4.5-next.1, =3.0.0, =1.0.1, =0.0.1, =1.0.42, =0.11.0, =0.1.0, =0.1.2 Source cves: CVE-2022-29172 Source advisory: OSV:GHSA-7WW6-75FJ-JCJ7...

@brudi-toolbox/id (>=1.4.5-next.1, <=2.0.4), @cimpress/simple-auth-wrapper (>=3.0.0, <=3.1.6) +6 more potentially affected by CVE-2022-29172 via auth0-lock (>=11.0.1, <=11.31.0)

auth0-lock NPM version =11.0.1, =1.4.5-next.1, =3.0.0, =1.0.1, =0.0.1, =1.0.42, =0.11.0, =0.1.0, =0.1.2 Source cves: CVE-2022-29172 Source advisory: GHSA-7WW6-75FJ-JCJ7...