CVE-2026-85982 Overview
The Auth0 Active Directory/Lightweight Directory Access Protocol (AD/LDAP) Connector contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. The flaw stems from improper HTML encoding of data rendered in the admin panel, specifically within directory search results and updater log content.
An authenticated user with rights to modify directory attributes can inject script content into LDAP fields. A low-privileged local user on the connector host can also inject payloads into updater log files. The injected script executes in the browser of any administrator who subsequently views the affected search results or logs.
Critical Impact
Successful exploitation lets an attacker execute arbitrary JavaScript in an administrator's authenticated session, enabling session hijacking, privilege escalation, and full compromise of the Auth0 AD/LDAP Connector admin interface.
Affected Products
- Auth0 AD/LDAP Connector (admin panel search results component)
- Auth0 AD/LDAP Connector (updater log rendering component)
- Refer to the Okta Security Advisory CVE-2026-85982 for exact fixed versions
Discovery Timeline
- 2026-09-08 - CVE-2026-85982 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-85982
Vulnerability Analysis
The Auth0 AD/LDAP Connector acts as a bridge between on-premises directory services and the Auth0 identity platform. It exposes an administrative web interface for managing directory synchronization, viewing search results, and reviewing update activity.
The connector fails to apply HTML output encoding on two rendering paths: directory search result fields and updater log entries. When an administrator navigates to these views, the browser interprets attacker-controlled markup as active content rather than as data. The stored nature of the flaw means payloads persist until the underlying directory attribute or log line is purged.
Because the vulnerability crosses trust boundaries between a directory operator (or local user) and an administrator, the CVSS scope is marked as Changed. Exploitation requires user interaction from the administrator, typically loading the affected admin view.
Root Cause
The root cause is missing or insufficient contextual output encoding when rendering untrusted strings inside HTML contexts in the admin panel. Directory attributes and updater log content are treated as safe rendered text, when they should be encoded to prevent script tag, event handler, or JavaScript URI execution.
Attack Vector
Two attack paths exist. First, an authenticated user with permission to modify directory attributes writes a payload such as a script tag into an LDAP field. Second, a low-privileged local user on the connector host inserts crafted content into files the updater ingests into its log stream.
When an administrator opens the search results view or the update log view in the admin panel, the payload executes in the administrator's browser under the origin of the connector admin interface. The attacker can then exfiltrate session tokens, submit administrative actions on the administrator's behalf, or pivot into connected Auth0 tenant configuration.
Refer to the Okta Security Advisory CVE-2026-85982 for advisory details.
Detection Methods for CVE-2026-85982
Indicators of Compromise
- LDAP attribute values containing HTML tags, <script> fragments, on* event handlers, or javascript: URIs where free-form text is not expected.
- Unexpected outbound requests originating from an administrator's browser session shortly after opening the connector admin panel.
- Modifications to updater log files on the connector host containing HTML or JavaScript payloads instead of standard log formatting.
Detection Strategies
- Audit LDAP directory attributes for values containing markup characters such as <, >, and quoted on attributes across user, group, and organizational unit objects.
- Correlate directory attribute modification events with subsequent administrator sessions on the AD/LDAP Connector admin panel.
- Inspect updater log files on the connector host for lines containing script content, unusual Unicode escapes, or characters that break expected log grammar.
Monitoring Recommendations
- Enable and forward Auth0 AD/LDAP Connector admin panel access logs and directory change events to a centralized logging platform.
- Monitor administrator browser sessions for anomalous DOM activity, new cross-origin requests, or unexpected token access following admin panel views.
- Alert on writes to updater log directories from processes other than the connector service account.
How to Mitigate CVE-2026-85982
Immediate Actions Required
- Upgrade the Auth0 AD/LDAP Connector to the fixed version identified in the Okta Security Advisory CVE-2026-85982.
- Review directory attributes and updater logs for existing injected payloads before restoring administrator access to the affected views.
- Rotate administrator session cookies and any credentials that may have been exposed to a compromised admin session.
Patch Information
Okta has published a security advisory addressing the stored XSS in the Auth0 AD/LDAP Connector. Administrators should apply the vendor-supplied update on every host running the connector. Consult the Okta Security Advisory CVE-2026-85982 for the specific fixed release and upgrade procedure.
Workarounds
- Restrict directory write permissions so only trusted service accounts can modify attributes rendered in the admin panel.
- Limit local access to the connector host and enforce least-privilege on directories where updater logs are written.
- Access the connector admin panel from a dedicated, hardened administrator workstation isolated from general browsing activity.
- Sanitize existing directory attribute values that contain HTML markup before opening the affected admin panel views.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
