Skip to content

v15.0.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 17:01
v15.0.2
df0e233
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This is a security patch release to address GHSA-mp8m-wcxp-w648 — a CWE-598 vulnerability where Active Directory passwords could be exposed in the /authorize redirect URL. All users of auth0-lock with Active Directory connections should upgrade to this version.

Security

  • [GHSA-mp8m-wcxp-w648] Fix Active Directory password exposure via /authorize query string (CWE-598). When defaultADUsernameFromEmailPrefix is enabled (the default), inputs with no local part (e.g. @corp.com) caused the login to route through an OAuth redirect instead of a credential POST, exposing the password in the URL. Fixed by tightening the transport-branch check to == null so empty strings are correctly routed to POST, and stripping password from authorize params as defense-in-depth.

Changed

  • Bump auth0-js from 10.2.0 to 10.2.1
Assets 2
Loading