CVE-2026-126129 | BDVDB-2026-404706 Detail

Auth0Auth0 ASP.NET Core Authentication

Description#

The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-807 Reliance on Untrusted Inputs in a Security Decision
CWE-287 Improper Authentication
CWE-1254 Incorrect Comparison Logic Granularity

References#

https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129

Exploit#

No public exploit known

History#

Version 12026-11-10Record published in the CVE List.