OktaOKTA-15NZJER

Improper Backchannel Session Revocation in the Auth0 ASP.NET Core Authentication SDK...

CVE-2026-126129 · Published Nov 10, 2026

Unrated

No fix yet

The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints. To remediate, upgrade the Auth0 ASP.NET Core Authentication SDK to version 1.12.0. or greater.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Details and references

Severity from: no source yet

More Okta advisories

All Okta

UnscoredNov 10

Improper Access Control in auth0-ai-python Document Retrieval CVE-2026-108167 - Nov 10...CVE-2026-108167no fix yet UnscoredNov 10

Improper Input Validation of Path Parameters Auth0 Node.js SDK CVE-2026-126128 - Nov 10...CVE-2026-126128no fix yet UnscoredNov 10

Improper Access Control in auth0-ai-js Document Retrieval CVE-2026-107372 - Nov 10, 2026CVE-2026-107372no fix yet Critical 9.8Oct 22

PHP Runtime Vulnerabilities Affecting Okta Access GatewayCVE-2026-109618no fix yet Critical 9.1Oct 22

Command Execution via Admin Console Input in Okta Access GatewayCVE-2026-115547no fix yet High 8.1Oct 22

Authentication Source Verification Issue in Okta Access GatewayCVE-2026-115546no fix yet