SB20261111121 - Reliance on Untrusted Inputs in a Security Decision in Auth0 ASP.NET Core Authentication SDK

Description

This security bulletin contains information about 1 vulnerability.

1) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-126129)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to access protected endpoints using a session that has already been revoked through OIDC Back-Channel Logout.

The vulnerability exists due to reliance on untrusted request attributes in the Auth0 ASP.NET Core Authentication SDK's session revocation check when OIDC Back-Channel Logout is enabled. A remote user can influence the request attribute used to resolve the Auth0 domain, such as the Host header, and present a previously issued session cookie whose session has been revoked to access protected endpoints despite logout.

The application must use a multi-tenant custom-domain configuration.

Remediation

Install update from vendor's website.

References

• https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129
• https://github.com/auth0/auth0-aspnetcore-authentication/security/advisories/GHSA-7fcj-4w3v-f6c9