CVE-2026-107370: Improper Request Handling for Active Directory Logins in auth0-lock
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
auth0-lockto a version that resolves this vulnerability.Fixed in 13.2.1
Event History
Frequently Asked Questions
Which deployments are exposed to this behavior?
Deployments using the npm auth0-lock library with an Active Directory connection are exposed when the submitted username is a domain without a local part.
What conditions are needed for sensitive form data to appear in a URL?
The affected Active Directory login flow must be initiated with a username that is only a domain, without a local part. Under that condition, auth0-lock uses a GET request and appends user-submitted form data as query parameters.
How can I check whether this has occurred?
Review authentication transaction requests for Active Directory logins. Affected events use GET rather than POST and contain submitted form fields in the request URL query string.