Cross-Site Scripting (XSS)

auth0-lock is vulnerable to cross-site scripting XSS. When using Passwordless or Enterprise connection mode, an attacker is able to inject and execute arbitrary Javascript in a victim's browser via the email or phone number in Passwordless connection, and the IdP domain in Enterprise connection...

DOM-based XSS

Overview Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection. For Passwordless connection, the value of the input email or phone number is displayed back to the user while waiting for...

DOM-based XSS in auth0-lock

Overview Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection. - For Passwordless connection, the value of the input email or phone number is displayed back to the user while waiting for...

PT-2020-14200

Name of the Vulnerable Software and Affected Versions auth0-lock versions prior to 11.26.3 Description The issue exposes applications and their users to cross-site scripting XSS attacks due to the use of dangerouslySetInnerHTML to update the DOM. This occurs when auth0-lock is used with...