Search: “Auth0”

Okta Patches Auth0 and Access Gateway Vulnerabilities Let Attackers Enable XSS, Authentication Bypass and SQL Injection

Okta patches three high-severity flaws in Auth0 AD/LDAP Connector and Access Gateway: stored XSS, auth bypass, SQL injection.

Okta disclosed on September 8, 2026 three vulnerabilities: CVE-2026-85982, a CVSS 9.0 stored XSS in Auth0 AD/LDAP Connector before 8.0.0; CVE-2026-78626, a CVSS 8.1 Protected Rule authorization bypass in Access Gateway before 2026.9.1; and CVE-2026-78623, a CVSS 7.7 SQL injection in Access Gateway advanced-mode datastores. Exploitation requires authenticated access and specific configurations. Fixes require upgrading the connector to 8.0.0+ and Access Gateway to 2026.9.1+.

GBHackers·Sep 11, 09:42 UTC · 5d agoVulnerability 2 sourcesCVE-2026-85982CVE-2026-78626CVE-2026-786231

Security Issue in JWT Secret Poisoning (Updated)

Palo Alto Unit 42·Jun 5, 17:06 UTC · Jun 5, 2024VulnerabilityCVE-2022-23529

RCE bug discovered in the popular JsonWebToken library

Security Affairs·Jan 10, 10:11 UTC · Jan 10, 2023VulnerabilityCVE-2022-23529

Researchers Find Security Flaw in JsonWebToken Library Used By 20,000+ Projects

Infosecurity Magazine·Jan 10, 17:00 UTC · Jan 10, 2023VulnerabilityCVE-2022-23529

Flock cameras are riddled with security vulnerabilities and hardcoded creds

Leaked Flock ALPR camera firmware reveals EOL Android 8.1, a 2017 Linux kernel, and hardcoded API keys granting access to production credentials.

DDoSecrets published filesystem images from an in-use Flock ALPR camera, obtained by the hacker collective stegan0gram and investigated by 404 Media and Wired. Micah Lee's analysis shows the camera runs Android 8.1 with a security patch level of 2018-06-05 and Linux kernel 3.18.71, missing roughly eight years of Android fixes. The firmware exposes a hardcoded API key for Flock's hpnotiq backend that can retrieve Auth0 client credentials for any camera by MAC address, with credentials stored in plaintext. Likely unpatched flaws include CVE-2021-1905 (Qualcomm Adreno use-after-free) and CVE-2018-9568 (WrongZone kernel socket type confusion); Flock says it received no reports via its disclosure policy.

Hacker News · security·Sep 16, 22:19 UTC · 6h agoVulnerability 3 sourcesHN 35↑ · 3 commentsCVE-2021-1905CVE-2018-9568