CVE-2026-85983
Local Privilege Escalation in Auth0 AD/LDAP Connector
- State
- Published
- Severity
- 7.8 High
- Published
- Sep 8, 2026
- Updated
- Sep 10, 2026
- Reserved
- Sep 4, 2026
Description
The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Okta |
Weaknesses
- CWE-94 Improper Control of Generation of Code
Affected Products
| Product | Versions |
|---|---|
Auth0 AD/LDAP ConnectorAuth0 |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.