CVE-2026-85981CWE-306

CVE-2026-85981

Medium · published September 9, 2026

CVSS v3.1
6.7
EPSS
0%
Percentile
7.7
In the wild
Unconfirmed
What it is

The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00185 · 7.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-09T01:18Z
References (1)
https://trust.okta.com/security-advisories/unauthenticated-localhost-admin-panel-in-auth0-ad-ldap-connector-cve-2026-85981 · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 20:17Z
    Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector
    cvelistv5