CVE-2026-107370
Received
Received - Intake
Authentication Bypass via GET Request in Auth0 Lock
Vulnerability report for CVE-2026-107370, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-13
Last updated on: 2026-10-13
Assigner: Okta
Description
Description
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Auth0 | auth0-lock | 10.9.0 |
| Auth0 | auth0-lock | 14.0.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
| CWE-598 | The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request. |
