Customer identity platform (now part of Okta).
CVE-2026-107370 is a medium-severity vulnerability in Auth0's auth0-lock library (CVSS 5.3) affecting versions 10.9.0–13.2.0 and 14.0.0–15.0.1. When a username for an Active Directory connection lacks a local part, the library incorrectly initiates authentication via GET request instead of POST, causing sensitive form data to be appended as URL query parameters. This enables information disclosure through URL history and logs. Updates are available in versions 13.2.1 and 15.0.2.
Okta has patched three high-severity vulnerabilities in Auth0 AD/LDAP Connector and Okta Access Gateway. CVE-2026-85982, a stored cross-site scripting (XSS) flaw in the Auth0 connector (CVSS 9.0), allows authenticated attackers to inject malicious scripts executed when administrators view search results or logs. CVE-2026-78626 (CVSS 8.1) permits authorization bypass in Protected Rules, and CVE-2026-78623 (CVSS 7.7) is an SQL injection vulnerability in Access Gateway's advanced-mode datastore. Organizations using these components should upgrade immediately.