GitHub Advisoryadvisory · NuGet

GHSA-c9cg-q8r2-xvjq Improper Authentication in Auth0.AuthenticationApi

HIGH Published 2019-10-24 Modified 2021-08-18 Official page ↗

Aliases: CVE-2019-16929
Ecosystem: NuGet
Packages: Auth0.AuthenticationApi
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses: CWE-287
Reviewed: 2019-10-24

Affected packages

• NuGet Auth0.AuthenticationApi: >= 5.8.0, < 6.5.4 → fixed in 6.5.4

Description

Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens.

Related

Alias · CVE (1)

CVE-2019-16929 Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID… vulnerability

Weakness · CWE (1)

CWE-287 Improper Authentication weakness

References