CVE-2026-107370
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request…
Published Oct 13, 2026 · updated Oct 14, 2026
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · Catalog
Detected
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.
Oct 14, 2026 · NIST NVD
Updated
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.
Sources
- CVE.orgCVE-2026-107370
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-107370
30-day exploitation probability 0.3%
first.org - NIST NVDCVE-2026-107370
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string paramete
nvd.nist.gov