CVE-2026-126129

Not scored yetLast modified Nov 12, 2026

Description

The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-287 CWE-807 CWE-1254

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Auth0	Auth0 ASP.NET Core Authentication	< 1.12.0

References

https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-126138.8Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on CVE-2026-126132When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment CVE-2026-126133When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the CVE-2026-126134Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Th CVE-2026-126135If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject CVE-2026-126136For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even w CVE-2026-1261448.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throu CVE-2026-1261457.2A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throu CVE-2026-1261467.2A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throu CVE-2026-1261479.8A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, Fo CVE-2026-1261489.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throu CVE-2026-1261497.5A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 thr