DOM-based XSS in auth0-lock

Description

Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection.

• For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input.

Recommendation

Update the auth0-lock package to the latest compatible version. Followings are version details:

• Affected version(s): <= 11.25.1
• Patched version(s): 11.26.3

References

• GHSA-6gg3-pmm7-97xc
• CVE-2020-15119
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• auth0-lock vulnerable to XSS via unsanitized placeholder property - CVE-2019-20174
• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes (GHSA-x8qp-wqqm-57ph) 4 - CVE-2025-53892
• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes (GHSA-x8qp-wqqm-57ph) 3 - CVE-2025-53892
• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes (GHSA-x8qp-wqqm-57ph) 2 - CVE-2025-53892

Tags:

npm

auth0-lock