CVE-2026-85982: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Auth0 Auth0 AD/LDAP Connector
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs.
CVE-2026-85982: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Auth0 Auth0 AD/LDAP Connector
Description
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs.
CVSS v3.1
Score 9.0critical
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Okta
- Date Reserved
- 2026-09-04T19:03:24.108Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa07239acd9273b4931f78b
Added to database: 09/08/2026, 20:38:17 UTC
Last updated: 09/08/2026, 20:38:17 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.