CVE-2019-16929: AUTH0 AUTH0.NET

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens.

Affected products

• AUTH0 AUTH0.NET: from 5.8.0, up to and including 6.5.3

Published 2019-10-08. Last modified 2026-06-17.