Improper Request Handling for Active Directory Logins in auth0-lock CVE-2026-107370 - Oct 13, 2026
Description
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.
Preconditions
The login form is used for an Active Directory connection, and a user submits a username that contains only the domain (e.g., @corp.com).
Affected product and versions
Customers using auth0-lock versions from 10.9.0 to 15.0.1 are affected.
Customer Recommendations
To remediate this vulnerability, upgrade auth0-lock to version 13.2.1, or version 15.0.2 and greater.
Resolution
The vulnerability is present in auth0-lock versions from 10.9.0 to 15.0.1, and is resolved in versions 13.2.1, and version 15.0.2 or greater.
CVE details
CVE ID | |
Published Date | 2026-10-13 |
Vulnerability Type | Sensitive Information Exposure (credential in URL query string) |
CWE | CWE-598 – Use of GET Request Method With Sensitive Query Strings CWE-532 – Insertion of Sensitive Information into Log File |
CVSS v3 | Score: 5.3 Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N |
References
Improper Request Handling for Active Directory Logins in auth0-lock