cve.bz

CVE-2026-126129

no score yet

auth0 auth0 asp.net core authentication: no CVSS score yet.

On this page
The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.
CWEs
CWE-287 Improper Authentication
CWE-807 Reliance on Untrusted Inputs in a Security Decision
CWE-1254 Incorrect Comparison Logic Granularity
OWASP Top 10
A06:2025 Insecure Design, A07:2025 Authentication Failures
Published
Assigned by
Okta (CNA)
NVD analysis
Awaiting analysis
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-126129 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-126129?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-126129?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-126129 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Affected

  • auth0:auth0 asp.net core authentication

Versions

From the CNA's record in the CVE List.

ProductAffected
Auth0 ASP.NET Core Authenticationbefore 1.12.0

Attack patterns (CAPEC)

  • CAPEC-26 Leveraging Race Conditions Likelihood: High · Severity: High
  • CAPEC-22 Exploiting Trust in Client Likelihood: High · Severity: High
  • CAPEC-57 Utilizing REST's Trust in the System Resource to Obtain Sensitive Data Likelihood: Medium · Severity: Very High
  • CAPEC-94 Adversary in the Middle (AiTM) Likelihood: High · Severity: Very High
  • CAPEC-114 Authentication Abuse Severity: Medium
  • CAPEC-115 Authentication Bypass Severity: Medium
  • CAPEC-151 Identity Spoofing Likelihood: Medium · Severity: Medium
  • CAPEC-194 Fake the Source of Data Severity: Medium
  • CAPEC-593 Session Hijacking Likelihood: High · Severity: Very High
  • CAPEC-633 Token Impersonation Severity: Medium

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits. More on the page of CWE-287.

References

Check your stackJSON