CVE-2026-107370— Improper Request Handling for Active Directory Logins in auth0-lock
Quick assessment
Affected
Auth0 auth0-lock
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
当 Active Directory 连接的用户名仅为域名而缺少本地部分（即不包含 "@" 符号）时，auth0-lock 库会使用 GET 请求而非 POST 请求来发起身份验证事务。因此，用户提交的表单数据会被附加为 URL 中的查询字符串参数。
Possible ATT&CK Techniques 1 AI
T1552.004 · Private Keys
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107370
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Request Handling for Active Directory Logins in auth0-lock
Source: CVE Program / CVE List V5
Vulnerability Description
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过GET请求中的查询字符串导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Auth0 | auth0-lock | 10.9.0 ~ 13.2.1 | - |
|
II. Public POCs for CVE-2026-107370
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107370
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-107370 (2)
Same Patch Batch · Auth0 · 2026-10-13 · 4 CVEs total
| CVE-2026-107369 | 6.1 MEDIUM | Improper Validation of Post-Login Redirect URL in nextjs-auth0 |
| CVE-2026-107371 | 5.4 MEDIUM | Missing Verification of auth_time Claim in auth0.js |
| CVE-2026-85473 | 5.3 MEDIUM | Out-of-Range Timestamp Claim Handling in auth0/java-jwt |
IV. Related Vulnerabilities
Same vendor: Auth0
-
CVE-2026-85473
Out-of-Range Timestamp Claim Handling in auth0/java-jwt -
CVE-2026-107371
Missing Verification of auth_time Claim in auth0.js -
CVE-2026-107369
Improper Validation of Post-Login Redirect URL in nextjs-aut -
CVE-2026-50157
Auth0 Symfony: Bearer Token Accepted via URL Query Parameter -
CVE-2026-84685
Improper Cache Isolation in auth0/react-native-auth0 SDK Web
Same weakness: CWE-598
-
CVE-2026-108808
Eleveo Call Recording Software JWT Token logout get request -
CVE-2026-81632
Single-use sign-in token placed in a redirect query string i -
CVE-2026-50157
Auth0 Symfony: Bearer Token Accepted via URL Query Parameter -
CVE-2026-88897
Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Qu -
CVE-2026-61614
SolidInvoice's long-lived API tokens accepted as URL query p
V. Comments for CVE-2026-107370
No comments yet