Improper Backchannel Session Revocation in the Auth0 ASP.NET Core Authentication SDK CVE-2026-126129 - Nov 10, 2026

Description

The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.

Affected product and versions

Customers using the Auth0 ASP.NET Core Authentication SDK versions prior to 1.12.0 are affected.

Preconditions

OIDC Back-Channel Logout is enabled, which is not the default.
The application uses a multi-tenant custom-domain configuration that resolves the Auth0 domain per request from an externally influenced request attribute such as the Host header.
A request presents a previously issued session cookie whose session has since been revoked through Back-Channel Logout.

Customer Remediations

To remediate this vulnerability, upgrade the Auth0 ASP.NET Core Authentication SDK to version 1.12.0 or greater.

Resolution

The vulnerability is present in the Auth0 ASP.NET Core Authentication SDK versions prior to and is resolved in version 1.12.0.

CVE details

CVE ID	CVE-2026-126129
Published Date	2026-11-10
Vulnerability Type	Improper Authentication (Reliance on Untrusted Input in a Session Revocation Check)
CWE	CWE-807 (Reliance on Untrusted Inputs in a Security Decision) CWE-287 (Improper Authentication) CWE-1254 (Incorrect Comparison Logic Granularity)
CVSS v3	Score: 5.9 (Medium) Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

References

Improper Backchannel Session Revocation in the Auth0 ASP.NET Core Authentication SDK