CVE-2026-107370: Use of GET Request Method With Sensitive Query Strings in Auth0 auth0-lock

The auth0-lock library in Auth0, when handling Active Directory connections where the username is a domain without a local part, initiates authentication transactions using HTTP GET requests rather than POST. This behavior results in user-submitted form data being appended to the URL as query string parameters, which can expose sensitive information through URL logging or browser history. The vulnerability affects versions >=10.9.0 <13.2.1 and >=14.0.0 <15.0.2. The CVSS 3.1 score is 5.3, indicating medium severity, with network attack vector, high complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Sensitive user data submitted during authentication can be exposed in URLs, which may be logged by servers, proxies, or visible in browser history, increasing the risk of information disclosure. There is no indication of integrity or availability impact. The vulnerability requires user interaction and has a high attack complexity, limiting exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using usernames that are domains without local parts in Active Directory connections or implement additional controls to prevent sensitive data exposure in URLs.