EUVD-2026-74186Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Directory-write or local access gives PR:L, an admin must view the sink (UI:R), and script in the admin session enables data theft and config changes (C:H/I:H) across a scope boundary (S:C); no direct availability impact.
Primary rating from Vendor (okta).
CVSS VectorVendor: okta
Lifecycle Timeline
2DescriptionCVE.org
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs.
AnalysisAI
Stored cross-site scripting in the Auth0 AD/LDAP Connector (versions up to and including 6.5.0) lets an attacker persist malicious script into directory-attribute search results or updater log content that later renders unencoded in the connector's admin panel, executing in an administrator's browser session. The payload can be planted either by an authenticated user permitted to modify directory attributes or by a low-privileged local user on the connector host, and fires when an admin views the affected search results or update logs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires one of two preconditions: (1) an authenticated principal with privileges to modify directory (AD/LDAP) attributes that are rendered in the connector's admin search results, or (2) a low-privileged local user account on the host where the connector is installed who can influence updater log content. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C, C:H/I:H/A:H, score 9.0) is aggressive for an admin-panel XSS: the C:H/I:H/A:H triple assumes script executing in the administrator's authenticated context can fully read and manipulate connector configuration and directory-bridging state, which is plausible but not independently verified. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Auth0 AD/LDAP Connector to a fixed release above 6.5.0 as directed in the Okta advisory (https://trust.okta.com/security-advisories/stored-cross-site-scripting-xss-in-auth0-ad-ldap-connector-cve-2026-85982); the input does not state an exact patched version number, so confirm the specific fixed build with Okta before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all deployed Auth0 AD/LDAP Connector instances and audit for versions ≤6.5.0; inventory all users with admin panel access; enable detailed logging of admin panel activity and directory modifications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today