Description
The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.
Published: 2026-11-10
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.
Weaknesses CWE-1254
CWE-287
CWE-807
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Okta

Published:

Updated: 2026-11-10T21:14:09.582Z

Reserved: 2026-11-10T18:52:30.790Z

Link: CVE-2026-126129

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-1254

    Incorrect Comparison Logic Granularity

  • CWE-287

    Improper Authentication

  • CWE-807

    Reliance on Untrusted Inputs in a Security Decision