CVE-2026-107370

EUVD-2026-100482
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
OktaCNA
5.3 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 19.2%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
auth0lock
10.9.0 ≤
𝑥
< 13.2.1
CNA
auth0lock
14.0.0 ≤
𝑥
< 15.0.2
CNA
Common Weakness Enumeration
References
https://github.com/auth0/lock/security/advisories/GHSA-mp8m-wcxp-w648
https://trust.okta.com/security-advisories/improper-request-handling-for-active-directory-logins-in-auth0-lock-cve-2026-107370