https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-27T06:24:51.797382+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-42660 EUVD-2026-42660 2026-10-27T06:24:51.799999+00:00 EUVD-2026-42660 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15119 fkie_cve-2020-15119 2026-10-27T06:24:51.800030+00:00

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.

 https://cve.radiocsirt.org/vuln/ghsa-6gg3-pmm7-97xc GHSA-6gg3-pmm7-97xc — DOM-based XSS in auth0-lock 2026-10-27T06:24:51.800060+00:00

Affected: npm: auth0-lock

### Overview Versions before and including `11.25.1` are using `dangerouslySetInnerHTML` to display an informational message when used with a Passwordless or Enterprise connection.

- For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input. - For Enterprise connection, the value of the input (IdP Domain) from the Enterprise connection setup screen (Auth0 Dashboard) is displayed back to the user when the `lock` widget opens.

When Passwordless or Enterprise connection is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.

### Am I affected? You are affected by this vulnerability if all of the following conditions apply:

- You are using auth0-lock - You are using Passwordless or Enterprise connection mode

### How to fix that? Upgrade to version `11.26.3`

### Will this update impact my users? The fix provided in patch will not affect your users.

### Credit https://github.com/mvisat

 https://cve.radiocsirt.org/vuln/gsd-2020-15119 gsd-2020-15119 2026-10-27T06:24:51.800093+00:00 gsd-2020-15119