9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-85982

CVE-2026-85982: Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs.

Miggo Vulnerability Database

→

CVE-2026-85982

CVE-2026-85982:

9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-85982, is a Stored Cross-Site Scripting (XSS) issue in the Auth0 AD/LDAP Connector, specifically affecting the display of search results and updater log content in the admin panel. The core problem was the improper HTML encoding of user-controlled data before it was rendered in the browser.

By analyzing the commit e18c2646887f2e5584395b00353eb5f9b82043c9, which explicitly mentions 'leftover XSS remediation', I identified key changes in admin/public/site.js.

Search Results XSS: The patch modified two anonymous JavaScript functions that were callbacks for AJAX requests to /users/by-login and /users/search. These functions previously used jQuery's .html() method to insert fetched data (which could include user-controlled directory attributes) directly into the #user-by-login-results and #users-search-results DOM elements. The .html() method interprets its input as HTML, making it susceptible to XSS. The fix correctly changed these to .text(), which treats the input as plain text and automatically escapes HTML entities, thus preventing script execution.
Updater Log Content XSS: The entire updater functionality, including the getUpdaterLogs function, was removed. The getUpdaterLogs function was responsible for displaying log data using $('#update-logs').html(sanitizeHtml(data)...). Even with a sanitizeHtml function, using .html() is a common vector for XSS if the sanitization is incomplete or bypassed. The removal of this feature and its associated rendering logic indicates it was a vulnerable component related to the XSS issue.

These functions are directly involved in processing and rendering user-influenced data without adequate output encoding, making them the precise points of vulnerability that would appear in a runtime profiler during an XSS attack.

Vulnerable functions

(anonymous function) (within $.get callback for /users/by-login)

admin/public/site.js

This anonymous function, part of the AJAX success callback for '/users/by-login', was vulnerable because it used the jQuery `.html()` method to insert potentially user-controlled data directly into the `#user-by-login-results` DOM element. The `.html()` method interprets its input as HTML, allowing for the execution of malicious scripts if the `data` variable contained crafted HTML or JavaScript payloads. The fix changed this to `.text()`, which safely escapes HTML characters.

(anonymous function) (within $.get callback for /users/search)

admin/public/site.js

Similar to the `/users/by-login` endpoint, this anonymous function in the AJAX success callback for '/users/search' was vulnerable. It used the jQuery `.html()` method to render search results into the `#users-search-results` DOM element. If the `data` returned from the server contained malicious HTML or script, it would be executed in the administrator's browser. The patch replaced `.html()` with `.text()` to prevent this.

getUpdaterLogs

admin/public/site.js

The `getUpdaterLogs` function was responsible for fetching and displaying updater log content. Although it attempted to sanitize the data using `sanitizeHtml()`, the use of `.html()` to insert this content into the `#update-logs` element indicates a potential vulnerability. The complete removal of this functionality suggests that the sanitization was either insufficient or the feature itself was deemed too risky for direct display in the admin panel, making the `getUpdaterLogs` function a vulnerable point for XSS through log content.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.