Improper Authentication in Auth0.AuthenticationApi · CVE-2019-16929 · GitHub Advisory Database · GitHub

Improper Authentication in Auth0.AuthenticationApi

High severity GitHub Reviewed Published Oct 24, 2019 to the GitHub Advisory Database • Updated May 30, 2023

Package

Auth0.AuthenticationApi (NuGet)

Affected versions

>= 5.8.0, < 6.5.4

Patched versions

6.5.4

Description

Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens.

References

Published by the National Vulnerability Database

Oct 8, 2019

Reviewed Oct 24, 2019

Published to the GitHub Advisory Database Oct 24, 2019

Last updated May 30, 2023

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N