A
Vendor security profile
auth0
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs12
Critical1
CISA KEV0
Public exploit0
Patch rate%25
Avg. CVSS6.6
12-month vulnerability rate
0
3
0
0
0
0
0
0
0
0
5
4
CVE KEV
CVE severity distribution
12toplam CVE
Critical1 (8%)
High3 (25%)
Medium8 (67%)
Patch and exploitation view
%25
Verified patch
%0
CISA KEV
%0
Public exploit
3Patch available
0Partial
0Workaround
0Vendor: no patch
9Unknown
Latest vulnerabilities
5.3
CVE-2026-85473
Out-of-Range Timestamp Claim Handling in auth0/java-jwt
A
Patch status unknown
5.4
CVE-2026-107371
Missing Verification of auth_time Claim in auth0.js
A
Patch status unknown
5.3
CVE-2026-107370
Improper Request Handling for Active Directory Logins in auth0-lock
A
Patch status unknown
6.1
CVE-2026-107369
Improper Validation of Post-Login Redirect URL in nextjs-auth0
A
Patch status unknown
6.5
CVE-2026-50157
Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK
A
Patch status unknownEPSS %1
6.5
CVE-2026-84685
Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management
A
Patch status unknownEPSS %0
7.8
CVE-2026-85983
Local Privilege Escalation in Auth0 AD/LDAP Connector
A
Patch status unknownEPSS %0
9.0
CVE-2026-85982
Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
A
Patch status unknownEPSS %0
6.7
CVE-2026-85981
Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector
A
Patch status unknownEPSS %0
7.5
CVE-2025-68129
Incorrect authorization in Auth0 PHP
A
Patch verifiedEPSS %0