// Auth0MEDIUM
CVE-2026-107370 is a medium-severity vulnerability in Auth0's auth0-lock library (CVSS 5.3) affecting versions 10.9.0–13.2.0 and 14.0.0–15.0.1. When a username for an Active Directory connection lacks a local part, the library incorrectly initiates authentication via GET request instead of POST, causing sensitive form data to be appended as URL query parameters. This enables information disclosure through URL history and logs. Updates are available in versions 13.2.1 and 15.0.2.
// Get alerts for Auth0