- Top reward
- $50,000
- Top severity paid
- Critical
- Assets in scope
- 25
- Public CVEs
- 41
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $50,000
- for critical bugs, from $100.
- Report through their form
- bugcrowd.com/engagements/auth0-okta
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$50,000 from $10,000 |
| High |
|
$10,000 from $4,000 |
| Medium |
|
$4,000 from $1,000 |
| Low |
|
$1,000 from $100 |
- Top reward
-
$50,000
P1 $ 10000 – $ 50000
- Lowest reward
-
$100
P4 $ 100 – $ 1000
- Safe harbor
-
Full
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
- Hall of fame
-
Yes
Hall of Fame
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
25 assets you may test, 11 excluded.
Domains 10
- auth0.com
- auth0.net
- config.cic-bug-bounty.auth0app.com
- jwt.io
- manage.cic-bug-bounty.auth0app.com
- marketplace.auth0.com
- openidconnect.net
- samltool.io
- webauthn.me
- webtask.run
Source code 8
- https://github.com/auth0/auth0-java
- https://github.com/auth0/auth0.js
- https://github.com/auth0/Auth0.Net
- https://github.com/auth0/auth0-php
- https://github.com/auth0/auth0-spa-js
- https://github.com/auth0/lock
- https://github.com/auth0/nextjs-auth0
- https://github.com/auth0/react-native-auth0
APIs 2
- https://api.us1.fga.dev
- https://customers.us1.fga.dev
Web 2
- https://dashboard.fga.dev
- https://play.fga.dev
Android apps 1
- Auth0 Guardian Android
iOS apps 1
- Auth0 Guardian IoS
Wildcard domains 1
- *.cic-bug-bounty.auth0app.com
Out of scope (11)
- accounts.auth0.com
- auth0.auth0.com
- community.auth0.com
- goextend.io
- manage.auth0.com
- phenix.rocks
- sharelock.io
- support.auth0.com
- Auth0 Docs (including quickstarts)
- Auth0 passport-ws-fed
- https://support.auth0.com/tickets/new
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Auth0's policy. "We" in these lines means the program, not this site.
While testing
-
Any use of automated scanning tools, DoS attempts, etc. will result in an immediate ban from the program.
-
If you are using Burp Intruder, do not exceed more than 5 requests per second.
-
Do not use tenants created through the bug bounty program for personal use.
-
Do not populate fields with your personal information.
-
Do not conduct non-technical attacks such as social engineering, phishing or unauthorized access to infrastructure.
-
Do not test the physical security of Auth0 offices, employees, equipment, etc.
-
If you gain access to servers, do not attempt to pivot. Stop all testing and report.
-
Customer data must not be affected in any way as a result of your testing.
-
Customer instances must not be accessed in any way.
-
The use of any automated tools or scanners is prohibited.
Not accepted
-
All subdomain takeovers
-
GitHub Actions Vulnerabilities
-
Double-dipping submissions
-
Abandoned/unclaimed domains, domain squatting, link rot, social media hijacking etc
-
Customize Login Page XSS
-
Race conditions that allow bypassing limits
-
Invalidating session on password change, reset, etc.
-
Incomplete proof of concepts
-
Theoretical vulnerabilities or issues
-
Host Header Redirect without user impact
-
HTTP 404 codes/pages or other HTTP non-200 codes/pages.
-
Fingerprinting / banner disclosure on common/public services.
-
Disclosure of known public files or directories, (e.g. robots.txt).
-
Clickjacking and issues only exploitable through clickjacking.
-
CSRF on forms that are available to anonymous users (e.g. login or contact form).
-
Logout / Login Cross-Site Request Forgery (logout CSRF).
-
Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.
-
Lack of Security Speedbump when leaving the site.
-
No Captcha / Weak Captcha / Captcha Bypass
-
Login or Forgot Password page brute force and account lockout not enforced
-
HTTP method enabled
-
WebServer Type disclosures
-
Social engineering of our service desk, employees or contractors
-
Physical attacks against Auth0's offices and data centers
-
Requiring a user's physical device
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-42280 | Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0. | High 7.1 | 27 May 2026 |
| CVE-2026-40155 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enab | Medium 5.4 | 17 Apr 2026 |
| CVE-2026-34236 | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0. | High 8.2 | 1 Apr 2026 |
| CVE-2025-68129 | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that | Medium 6.8 | 17 Dec 2025 |
| CVE-2025-67716 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw in the returnTo parameter, which could allow attackers to inject unintended OAuth query parameters into the Auth0 authorization request. Successful exploitation may result in tokens being issued with unintended parameters. This issue is fix | Medium 5.7 | 11 Dec 2025 |
| CVE-2025-67490 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1. | Medium 5.4 | 10 Dec 2025 |
| CVE-2025-65945 | auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected h | High 7.5 | 4 Dec 2025 |
| CVE-2022-23539 | Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0 | Medium 5.9 | 23 Dec 2022 |
| CVE-2022-23540 | In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for t | Medium 6.4 | 22 Dec 2022 |
| CVE-2022-23541 | jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than t | Medium 5.0 | 22 Dec 2022 |
| CVE-2022-23505 | Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g wi | Medium 5.3 | 13 Dec 2022 |
| CVE-2022-29172 | Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. In versions before `11.33.0`, when the “additional signup fields” feature [is configured](https://github.com/auth0/lock#additional-sign-up-fields), a malicious actor can inject invalidated HTML code into these additional fields, which is then | Medium 6.1 | 5 May 2022 |
| CVE-2022-24794 | Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under `example.com` are protected with the `requiresAuth` middleware, a visit to | High 7.5 | 31 Mar 2022 |
| CVE-2021-43812 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue. | Medium 6.4 | 16 Dec 2021 |
| CVE-2021-41246 | Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue. | Medium 4.6 | 9 Dec 2021 |
| CVE-2021-32702 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message. You are affected by this vulnerability if you are using `@auth0/n | High 8.0 | 25 Jun 2021 |
| CVE-2021-32641 | auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage` or the library's `languageDictionary` feature is utilized and user input or data from URL paramet | High 8.1 | 4 Jun 2021 |
| CVE-2020-15259 | ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidential data loss. CSRF exploits may occur if the user visits a malicious page containing CSRF payload on the same machine that has access to the ad-ldap-connector admin console via a browser. You may be affected if you use the admin console inclu | High 8.1 | 6 Nov 2020 |
| CVE-2020-15240 | omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all of the following conditions apply: 1. You are using `omniauth-auth0`. 2. You are using `JWTVali | High 7.4 | 21 Oct 2020 |
| CVE-2020-15119 | In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks. | Medium 6.4 | 20 Aug 2020 |
| CVE-2020-15125 | In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer token. You are affected by this vulnerability if you are using the auth0 npm package, and you are using | High 7.7 | 29 Jul 2020 |
| CVE-2020-15084 | In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **alg | High 7.7 | 30 Jun 2020 |
| CVE-2020-5263 | auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification, the application risks password exposure. This | Medium 5.5 | 9 Apr 2020 |
| CVE-2020-5391 | Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field. | High 8.8 | 1 Apr 2020 |
| CVE-2020-5392 | A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page. | Medium 6.1 | 1 Apr 2020 |
| CVE-2020-6753 | The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392. | Medium 6.1 | 1 Apr 2020 |
| CVE-2020-7947 | An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at least) CSV injection if a crafted Excel document is uploaded. | Critical 9.8 | 1 Apr 2020 |
| CVE-2020-7948 | An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference. | High 8.8 | 1 Apr 2020 |
| CVE-2019-20173 | The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php. | Medium 6.1 | 5 Feb 2020 |
| CVE-2019-20174 | Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder. | Medium 6.1 | 3 Feb 2020 |
| CVE-2019-16929 | Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens. | High 7.5 | 8 Oct 2019 |
| CVE-2019-13483 | Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms. | High 7.3 | 25 Jul 2019 |
| CVE-2019-7644 | Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application. | Critical 9.8 | 11 Apr 2019 |
| CVE-2018-15121 | An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations. | High 8.8 | 29 Aug 2018 |
| CVE-2018-11537 | Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain. | Medium 6.5 | 19 Jun 2018 |
| CVE-2015-9235 | In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family). | Critical 9.8 | 29 May 2018 |
| CVE-2018-6873 | The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated. | Critical 9.8 | 4 Apr 2018 |
| CVE-2018-6874 | CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. | High 8.8 | 4 Apr 2018 |
| CVE-2018-7307 | The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter. | High 8.8 | 6 Mar 2018 |
| CVE-2017-16897 | A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within the response). | High 8.1 | 27 Dec 2017 |
| CVE-2017-17068 | A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback(). | High 7.5 | 6 Dec 2017 |