CVE-2021-32641 | BDVDB-2026-154808 Detail

Description#

auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage` or the library's `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`. The vulnerability is patched in version 11.30.1.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12021-06-04Record published in the CVE List.
2. Version 22024-08-03Most recent update recorded in the CVE List.