CVE-2021-32641

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage` or the library's `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`. The vulnerability is patched in version 11.30.1.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-326429.4radsecproxy is a generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports. Missing input validation in radsecproxy's `CVE-2021-326435.8Http4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme i CVE-2021-326445.4Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are CVE-2021-326456.1Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have ope CVE-2021-326467.3Roomer is a discord bot cog (extension) which provides automatic voice channel generation as well as private voice and text channels. A vuln CVE-2021-326479.1Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Executi CVE-2021-326489.1octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request CVE-2021-326498.8October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.CVE-2021-326508.8October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.CVE-2021-326514.3OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an CVE-2021-326524.3Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another CVE-2021-326532.7Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user