CVE-2026-85981
MediumCVSS 6.7Summary
The administrative panel of Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings.
Risk Assessment
The risk includes unauthorized access to sensitive credentials and the ability to alter configuration, potentially leading to compromise of service accounts and further attacks in the Active Directory environment.
Recommendation
It is recommended to immediately update Auth0 AD/LDAP Connector to a version newer than 6.5.0 if available, and restrict access to the administrative panel only to trusted users and processes.
Other vulnerabilities in Auth0 AD/LDAP Connector
See all- CVE-2026-85983High
The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.
- CVE-2026-85982Critical
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host, could insert script content that executes in an administrator's browser.
Original NVD description (English source)
The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings.