CVE-2026-85982

CriticalCVSS 9.0

Published: 08/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Summary

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host, could insert script content that executes in an administrator's browser.

Risk Assessment

Script execution in an administrator's browser could lead to session theft, unauthorized actions, or administrator account compromise.

Recommendation

Upgrade the Auth0 AD/LDAP Connector to the latest patched version and restrict user privileges to modify directory attributes.

Other vulnerabilities in Auth0 AD/LDAP Connector

CVE-2026-85983High
The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.

Original NVD description (English source)

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs.