DOM-based XSS in auth0-lock
Overview
Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection.
- For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input.
- For Enterprise connection, the value of the input (IdP Domain) from the Enterprise connection setup screen (Auth0 Dashboard) is displayed back to the user when the
lockwidget opens.
When Passwordless or Enterprise connection is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.
Am I affected?
You are affected by this vulnerability if all of the following conditions apply:
- You are using auth0-lock
- You are using Passwordless or Enterprise connection mode
How to fix that?
Upgrade to version 11.26.3
Will this update impact my users?
The fix provided in patch will not affect your users.
Credit
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | auth0-lock | < 11.26.3 | 11.26.3 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N- Weakness (CWE)
CWE-79- Platform
- npm
- Package
auth0-lock- Disclosed
- 19.08.2020
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-6gg3-pmm7-97xc - CC BY 4.0
Vulnerability history: auth0-lock
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 01.2020 05.2022
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 2
- Low 1
Disclosures per year
- 2020: 2
- 2021: 1
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
DOM-based XSS in auth0-lock this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.