Description
Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection.
- For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input.
Recommendation
Update the auth0-lock package to the latest compatible version. Followings are version details:
- Affected version(s): <= 11.25.1
- Patched version(s): 11.26.3
References
Could your website be exposed too?
SmartScanner can check your website for DOM-based XSS in auth0-lock and gives you actionable findings to investigate.
Start a free scanRelated Issues
- auth0-lock vulnerable to XSS via unsanitized placeholder property - CVE-2019-20174
- CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage - CVE-2026-26862
- CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function - CVE-2026-26861
- DOM-based XSS in gmail-js - CVE-2016-1000228
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023