CVE-2026-85981 PUBLISHED

Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector

Assigner: Okta
Reserved: 04.09.2026 Published: 08.09.2026 Updated: 08.09.2026

The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 6.7

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Auth0
Product	Auth0 AD/LDAP Connector
Versions	Default: unaffected affected from 0 to 6.5.0 (incl.)

Solutions

Upgrade the Auth0 AD/LDAP Connector to version 7.0.0 or greater.

References

https://trust.okta.com/security-advisories/unauthenticated-localhost-admin-panel-in-auth0-ad-ldap-connector-cve-2026-85981

Problem Types

Missing Authentication for Critical Function