CVE-2019-16929 Improper Authentication in Auth0.AuthenticationApi
Attackers can bypass authentication by exploiting incorrect access control in the IdentityTokenValidator of the Auth0 .NET SDK.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-16929?
CVE-2019-16929 is a high-severity authentication bypass vulnerability in n/a, published on 8 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens.
Weakness: CWE-287
Which versions are affected by CVE-2019-16929?
2 open source packages ship an affected version, including Auth0.AuthenticationApi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Auth0.AuthenticationApi NuGet | From 5.8.0 | 6.5.4 |
Auth0.AuthenticationApi NuGet | From 5.8.0 | 6.5.4 |
Products include Auth0 Auth0.net.
How do I fix CVE-2019-16929?
Upgrade Auth0.AuthenticationApi to 6.5.4 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-16929 being exploited?
There is no known exploitation of CVE-2019-16929 in the wild and no public exploit code.
Sources
Also known as GHSA-c9cg-q8r2-xvjq.