Okta platform and SDKs
CVE-2026-85981: Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector
The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Auth0 AD/LDAP Connector 0 to 6.5.0 | Upgrade past 6.5.0; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 12 Oct 2026.