CVE-2026-85982 in AD LDAP Connector
Summary
by MITRE • 09/09/2026
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host where the connector is installed, could insert script content. This script content could then execute in an administrator's browser when they view the affected search results or update logs.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The Auth0 AD/LDAP Connector contains a critical stored Cross-Site Scripting vulnerability that stems from insufficient input validation and improper HTML encoding of user-supplied data within administrative interface components. This flaw specifically affects two distinct areas: the display of directory search results and the presentation of updater log content in the admin panel. The root cause lies in the application's failure to sanitize or encode special characters before rendering them as part of the Hypertext Markup Language structure, allowing malicious script payloads to be embedded directly into the page source code rather than being treated as inert text data.
The attack vector for this vulnerability is particularly concerning because it does not require direct interaction with a vulnerable input field at the time of exploitation by an attacker who might otherwise intercept network traffic. Instead, the persistence mechanism relies on privilege escalation or local system compromise to inject malicious content into directory attributes or log files that are subsequently displayed in the administrative console. An authenticated user possessing privileges to modify Active Directory or LDAP directory attributes can craft specific attribute values containing executable JavaScript code. Similarly, a low-privileged local user with access to the host machine where the connector is installed may manipulate updater logs by writing malicious strings into system log files if file write permissions are misconfigured or overly permissive.
Once this script content is stored within these data structures, it remains dormant until an administrator views the affected search results or updates through the web-based admin panel. At that moment, the browser parses the unencoded HTML entities and executes the embedded JavaScript in the context of the authenticated session. This execution environment grants the malicious scripts full access to the administrative interface's Document Object Model, allowing for actions such as stealing session cookies, capturing authentication tokens, performing unauthorized configuration changes on behalf of the administrator, or redirecting the user to phishing sites designed to harvest credentials. The impact is severe because it bypasses traditional network-based security controls by leveraging trusted administrative sessions and client-side execution contexts.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, the stored nature of the attack corresponds to CWE-80 Stored XSS where malicious scripts are permanently stored within target servers such as databases or log files. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1059 Command and Scripting Interpreter via browser-based execution and potentially T1204 User Execution if the initial vector involves tricking an admin into viewing compromised logs. The vulnerability also reflects CWE-601 URL Redirection to Untrusted Site which may be a secondary effect of script injection leading to phishing or credential theft operations.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Auth0 has released patches that enforce strict output encoding for all dynamic content rendered in the admin panel, ensuring that special characters are converted into their corresponding HTML entities before display. Administrators should immediately apply these updates to prevent exploitation of existing stored payloads. Beyond patching, organizations must review access controls surrounding directory attribute modifications and log file writes on connector hosts. Implementing least-privilege principles ensures that only necessary service accounts can write to critical configuration or logging directories, reducing the risk of local privilege escalation leading to application-level compromise. Additionally, deploying Content Security Policy headers in administrative interfaces can provide an additional layer of defense by restricting script execution sources and mitigating the impact of any future injection attempts.