The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
Upgrade the Auth0 AD/LDAP Connector to version 7.0.0 or greater.
Workaround
No workaround given by the vendor.
References
History
Tue, 08 Sep 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs. | |
| Title | Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Okta
Published:
Updated: 2026-09-08T20:17:40.063Z
Reserved: 2026-09-04T19:03:24.108Z
Link: CVE-2026-85982
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-08T21:18:47.293
Modified: 2026-09-08T21:18:47.293
Link: CVE-2026-85982
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses