CVE-2026-126129

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.

CWE	CWE-807 CWE-287 CWE-1254
Vendor	auth0
Product	auth0 asp.net core authentication
Published	Nov 10, 2026

Stay Ahead of the Next One

Get instant alerts for auth0 auth0 asp.net core authentication

Be the first to know when new unknown vulnerabilities affecting auth0 auth0 asp.net core authentication are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Auth0 / Auth0 ASP.NET Core Authentication

0 < 1.12.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

trust.okta.com: https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129