CVE-2020-15119: DOM-based XSS in auth0-lock
Summary
CVE-2020-15119: DOM-based XSS in auth0-lock. Affects auth0-lock versions < 11.26.3. Fixed in 11.26.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Auth0 Lock is a library for implementing authentication and authorization in web applications. It provides a customizable login interface that integrates with various identity providers. The library is commonly used in applications that utilize Passwordless or Enterprise connection modes. These modes allow users to authenticate using email, phone numbers, or third-party identity providers. However, versions before and including 11.25.1 of auth0-lock are vulnerable to a DOM-based cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability arises from the use of dangerouslySetInnerHTML to display user input values in certain scenarios. In Passwordless connection mode, the value of the input (email or phone number) is displayed back to the user while waiting for a verification code input. In Enterprise connection mode, the value of the input (IdP Domain) from the Enterprise connection setup screen is displayed back to the user when the lock widget opens. This allows an attacker to inject malicious scripts that will be executed in the context of the vulnerable application, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Latest published version: 15.0.2 as of 23 Oct 2026
npm install auth0-lock@15.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.26.3
This is the first release that contains the fix.
npm install auth0-lock@11.26.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to mitigate the risk of exploitation.
Conclusion
Upgrading to version 11.26.3 of auth0-lock is crucial to protect your application and users from the DOM-based XSS vulnerability. This upgrade will not impact your users, and it is the recommended solution to mitigate the risk of exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for auth0-lock →
FAQ
You are affected by this vulnerability if you are using auth0-lock and either the Passwordless or Enterprise connection mode.
No, the fix provided in the patch will not affect your users.
The severity of this vulnerability is rated as LOW with a CVSS score of 6.4.
The CWE ID associated with this vulnerability is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-6gg3-pmm7-97xc/GHSA-6gg3-pmm7-97xc.json
References
Related vulnerabilities
Recent vulnerabilities recorded for auth0-lock.
