CVE-2021-32641

auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage` or the library's `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`. The vulnerability is patched in version 11.30.1.

• CWE-79

• https://github.com/auth0/lock/commit/d139cf01c8234b07caf265e051f39d3eab08f7edPatch, Third Party Advisory
• https://github.com/auth0/lock/releases/tag/v11.30.1Release Notes, Third Party Advisory
• https://github.com/auth0/lock/security/advisories/GHSA-jr3j-whm4-9wwmExploit, Third Party Advisory
• https://github.com/auth0/lock/commit/d139cf01c8234b07caf265e051f39d3eab08f7edPatch, Third Party Advisory
• https://github.com/auth0/lock/releases/tag/v11.30.1Release Notes, Third Party Advisory
• https://github.com/auth0/lock/security/advisories/GHSA-jr3j-whm4-9wwmExploit, Third Party Advisory

Published

Jun 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32635Singularity is an open source container platform. In verions…6.3
• CVE-2021-32637Authelia is a a single sign-on multi-factor portal for web a…10
• CVE-2021-32638Github's CodeQL action is provided to run CodeQL-based code …4.4
• CVE-2021-32639Emissary is a P2P-based, data-driven workflow engine. Emissa…9.9
• CVE-2021-3264SQL Injection vulnerability in cxuucms 3.1 ivia the pid para…7.2
• CVE-2021-32640ws is an open source WebSocket client and server library for…5.3
• CVE-2021-32642radsecproxy is a generic RADIUS proxy that supports both UDP…9.4
• CVE-2021-32643Http4s is a Scala interface for HTTP services. `StaticFile.f…5.8
• CVE-2021-32644Ampache is an open source web based audio/video streaming ap…5.4
• CVE-2021-32645Tenancy multi-tenant is an open source multi-domain controll…6.1
• CVE-2021-32646Roomer is a discord bot cog (extension) which provides autom…7.3
• CVE-2021-32647Emissary is a P2P based data-driven workflow engine. Affecte…9.1