Reliance on Untrusted Inputs in a Security Decision in Auth0 ASP.NET Core Authentication SDK - CVE-2026-126129

Vulnerability details

The vulnerability allows a remote user to access protected endpoints using a session that has already been revoked through OIDC Back-Channel Logout.

The vulnerability exists due to reliance on untrusted request attributes in the Auth0 ASP.NET Core Authentication SDK's session revocation check when OIDC Back-Channel Logout is enabled. A remote user can influence the request attribute used to resolve the Auth0 domain, such as the Host header, and present a previously issued session cookie whose session has been revoked to access protected endpoints despite logout.

The application must use a multi-tenant custom-domain configuration.

Affected software

How to mitigate CVE-2026-126129

External References

• https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129
• https://github.com/auth0/auth0-aspnetcore-authentication/security/advisories/GHSA-7fcj-4w3v-f6c9

Related Security Bulletins

• Reliance on Untrusted Inputs in a Security Decision in Auth0 ASP.NET Core Authentication SDK