CVE-2026-107370

5.3 MEDIUMpublic exploit available

Published 2026-10-13 · Updated 2026-10-15

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weaknesses

CWE-532, CWE-598

Public exploit & PoC references

https://github.com/auth0/lock/security/advisories/GHSA-mp8m-wcxp-w648

All references

https://github.com/auth0/lock/security/advisories/GHSA-mp8m-wcxp-w648
https://trust.okta.com/security-advisories/improper-request-handling-for-active-directory-logins-in-auth0-lock-cve-2026-107370

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2023-54407PoC
HIGHCVE-2025-71423PoC
HIGHCVE-2025-71425PoC
MEDIUMCVE-2026-101168
HIGHCVE-2026-103371
UNSCOREDCVE-2026-104055PoC
MEDIUMCVE-2026-104872PoC
MEDIUMCVE-2026-106035

Related by shared AI tags and CWE weakness class. Browse the full archive.