CVE-2026-85982
Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
CVSS Score
9.0
EPSS Score
0.0%
EPSS Percentile
0th
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs.
| CWE | CWE-79 |
| Vendor | auth0 |
| Product | auth0 ad/ldap connector |
| Published | Sep 8, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for auth0 auth0 ad/ldap connector
Be the first to know when new critical vulnerabilities affecting auth0 auth0 ad/ldap connector are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Auth0 / Auth0 AD/LDAP Connector
0 ≤ 6.5.0