CVE-2026-85982: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Auth0 Auth0 AD/LDAP Connector

The Auth0 AD/LDAP Connector suffers from stored XSS due to improper neutralization of input during web page generation. Specifically, data in search results and updater log content is not properly HTML-encoded before display in the admin panel. Authenticated users with certain privileges or local users on the host can insert malicious scripts that execute in administrators' browsers. This vulnerability affects versions from 0 up to and including 6.5.0. The CVSS 3.1 base score is 9.0, reflecting network attack vector, low attack complexity, privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows script execution in an administrator's browser, enabling actions such as session hijacking, credential theft, or administrative control compromise. The vulnerability impacts confidentiality, integrity, and availability of the affected system. It requires an authenticated user with directory attribute modification privileges or a local user on the host to inject malicious content, which then executes when an administrator views affected UI components.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to users with directory attribute modification privileges and limit local user access to the host. Administrators should exercise caution when viewing search results and update logs. Monitor vendor channels for official fixes or mitigations.