CVE-2026-107370
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Oct 13, 2026
Vendor
unknown
Description
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters.