Improper Authentication in Auth0.AuthenticationApi

HIGH 7.5CVE-2019-16929 · GHSA-c9cg-q8r2-xvjq · Published 08/10/2019 · updated 17/06/2026

In short

CVE-2019-16929 is a HIGH (CVSS 7.5) vulnerability affecting Auth0.AuthenticationApi, auth0.net (auth0).
Chance of exploitation in the next 30 days (EPSS): 0.89%, higher than 59.4% of all vulnerabilities.
Fix: update to 6.5.4 or later.

Package	Affected versions	Patched versions
Auth0.AuthenticationApi NuGet	`≥ 5.8.0, < 6.5.4`	`6.5.4`
auth0.net auth0	`≥ 5.8.0, ≤ 6.5.3`	No fix yet

Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens.

NVD description

Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.