CVE-2026-107370

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass via GET Request in Auth0 Lock

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Okta

Description

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107370

EUVD

EUVD-2026-100482

Affected Vendors & Products

Vendor	Product	Version / Range
Auth0	auth0-lock	10.9.0
Auth0	auth0-lock	14.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.
CWE-598	The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when an Active Directory username lacks a local part and includes only a domain. The auth0-lock library then uses a GET request for authentication instead of a POST request. This causes user-submitted form data to be appended to the URL as query parameters, potentially exposing sensitive information.

Impact Analysis

The vulnerability may lead to exposure of sensitive data in URLs, such as credentials or session tokens, which could be intercepted or logged. It also increases the risk of phishing attacks by revealing user input in URLs.

Mitigation Strategies

Update the auth0-lock library to the latest version to address the improper request handling. Review Active Directory connection configurations to ensure usernames include a local part for domain accounts. Monitor network traffic for GET requests containing sensitive form data in URLs.

Hi! I’m here to help you understand CVE-2026-107370. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70