medium5.3
CVE-2026-107370
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET…
Impact
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.