CVE-2026-85981

Received Received - Intake

Auth0 AD/LDAP Connector Local Admin Panel Credential Exposure

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: Okta

Description

The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-09

AI Q&A

2026-09-09

EPSS Evaluated

N/A

NVD

CVE-2026-85981

Affected Vendors & Products

Vendor	Product	Version / Range
auth0	ad_ldap_connector	to 6.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Auth0 AD/LDAP Connector versions 6.5.0 and earlier. The administrative panel listens on the local loopback interface without requiring authentication. A local low-privileged user or process can access management endpoints without credentials and read or modify sensitive configuration details, including plaintext Active Directory service account credentials.

Detection Guidance

Check if the Auth0 AD/LDAP Connector administrative panel is listening on the local loopback interface (127.0.0.1) without authentication. Use commands like 'netstat -tuln | grep 127.0.0.1' or 'ss -tuln | grep 127.0.0.1' to verify listening ports. Inspect running processes for the connector service and review its configuration files for exposed endpoints.

Impact Analysis

An attacker with local access could exploit this to steal plaintext Active Directory credentials, gain unauthorized access to systems, or modify connector settings to disrupt operations. This could lead to data breaches, unauthorized system access, or service disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Upgrade the Auth0 AD/LDAP Connector to a version that enforces authentication on the administrative panel. If an upgrade is not immediately possible, restrict access to the loopback interface by configuring a firewall rule to block external connections. Additionally, rotate all Active Directory service account credentials that may have been exposed.

Hi! I’m here to help you understand CVE-2026-85981. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70