CVE-2026-85982: Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Auth0 AD/LDAP Connectorto a version that resolves this vulnerability.Fixed in 7.0.0
Event History
Frequently Asked Questions
Who could inject the malicious script content?
An authenticated user who can modify directory attributes can insert script content into affected search-result data. A low-privileged local user on the host running the connector can also insert script content through updater log content.
What must happen for the stored XSS to execute?
An administrator must view the affected directory search results or updater logs in the connector's admin panel. The injected content then executes in that administrator's browser.
Are remote unauthenticated attackers able to inject the payload directly?
The described injection paths require either authenticated privileges to modify directory attributes or local low-privileged access to the connector host. The provided information does not identify an unauthenticated injection path.