CVE-2026-85982

The Auth0 AD/LDAP Connector fails to properly HTML-encode directory data shown in search results and updater log content within its admin panel, allowing stored Cross-Site Scripting (CWE-79). An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector runs, can insert script content that is later rendered to an administrator. When an administrator views the affected search results or update logs, the injected script executes in the admin's browser, enabling session-context actions with high confidentiality, integrity, and availability impact per the CVSS scope-changed rating (9.0, critical). Only organizations running the self-hosted Auth0 AD/LDAP Connector to federate on-premises Active Directory/LDAP with Auth0 are affected. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS assigns only a 0.2% probability of exploitation within 30 days, so no active exploitation is currently known.

What to do: Update the AD/LDAP Connector to the fixed release published by Okta/Auth0 (consult the vendor advisory for the exact patched version, since none is listed here), and verify via the connector's updater/admin panel that the new build is deployed. In the meantime, restrict which accounts can modify directory attributes and limit local logon access on the connector host, and have administrators inspect any directory attribute values or updater log entries from untrusted users before viewing them in the admin panel.