Auth0 by Okta runs two public programs: a Bugcrowd bug bounty paying up to $50,000 and a self-hosted bug bounty paying up to $50,000.
- Top reward
- $50,000
- Bugcrowd
- Programs
- 2
- 2 pay cash
- Targets in scope
- 28
- 8 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Auth0 by Okta
Bugcrowd · Pays the most of the 2 programs: up to $50,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Auth0 by Okta
Bugcrowd · Bug bounty |
$50k (highest) | $10k (highest) | $4,000 (highest) | $1,000 (highest) | $50,000 | Full | – | – | Open |
|
Auth0
Self-hosted · Bug bounty |
$50k | $10k | $4,000 | $1,000 | $50,000 | Full | – | – | Open |
-
- Critical
- $50k (highest)
- High
- $10k (highest)
- Medium
- $4,000 (highest)
- Low
- $1,000 (highest)
- Safe harbor
- Full
-
- Critical
- $50k
- High
- $10k
- Medium
- $4,000
- Low
- $1,000
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
28 targets across all 2 programs, each listed once with the programs that cover it. 12 excluded.
-
https://play.google.com/store/apps/details?id=com.auth0.guardian&hl=en_US&gl=US
Android
Covered by Bugcrowd
No target matches. Try part of a host name, such as the company name.
Out of scope 12
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
accounts.auth0.com
Self-hosted Bugcrowd
-
community.auth0.com
Self-hosted Bugcrowd
-
goextend.io
Self-hosted Bugcrowd
-
support.auth0.com
Self-hosted Bugcrowd
-
Auth0 Docs (including quickstarts)
Self-hosted Bugcrowd
-
auth0.auth0.com
Bugcrowd Self-hosted
-
https://support.auth0.com/tickets/new
Self-hosted Bugcrowd
-
manage.auth0.com
Bugcrowd Self-hosted
-
phenix.rocks
Bugcrowd Self-hosted
-
sharelock.io
Bugcrowd Self-hosted
-
Auth0 passport-ws-fed
Self-hosted
-
https://github.com/auth0/passport-wsfed-saml2
Bugcrowd
Recent changes
Reward and scope changes across every Auth0 by Okta program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Auth0 by Okta products, from the NVD.
-
CVE-2026-42280 High
Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.
-
CVE-2026-40155 Medium
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enab
-
CVE-2026-34236 High
Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0.
-
CVE-2025-68129 Medium
Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that
-
CVE-2025-67716 Medium
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fix
-
CVE-2025-67490 Medium
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.
-
CVE-2025-65945 High
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected h
-
CVE-2022-23539 Medium
Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0
About this page
This page gathers every public program listed under auth0.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.