CVE-2026-126129
UnknownEPSS 0.23%
Last modified
CVE-2026-126129 is a vulnerability of currently unknown severity. The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Auth0 | Auth0 ASP.NET Core Authentication | < 1.12.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-126129?
The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.
How severe is CVE-2026-126129?
Severity scoring for CVE-2026-126129 is pending analysis. The EPSS model estimates a 0.23% probability of exploitation in the next 30 days.
How do I fix CVE-2026-126129?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12609In Eclipse Theia versions 1.66.0 and up until including 1.73…7.5
- CVE-2026-1261The MetForm Pro plugin for WordPress is vulnerable to Stored…7.2
- CVE-2026-12610A flaw was found in sssd. When authenticating with a YubiKey…6.4
- CVE-2026-12611A client may issue HTTP/2 requests to a Jetty server that re…8.7
- CVE-2026-126123BeeS Software Solutions ERP before 04 September 2026 allows …6.5
- CVE-2026-126128The Management API client in the Auth0 Node.js SDK improperl…
- CVE-2026-12613Deserialization of untrusted data vulnerability in Ministry …8.8
- CVE-2026-126132When a message was forwarded inline, edited as new, or had a…
- CVE-2026-126133When a CalDAV or ICS calendar was accessed through an HTTP p…
- CVE-2026-126134Thunderbird allowed feed subscriptions to file: URLs that po…
- CVE-2026-126135If an attacker was able to perform a man-in-the-middle attac…
- CVE-2026-126136For Exchange accounts using EWS or Microsoft Graph with OAut…
Are you affected by CVE-2026-126129?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST