# \#security **URL:** https://community.auth0.com/tag/security/285.md [Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md) --- ## [Is Auth0 affected by CVE-2026-98432?](https://community.auth0.com/t/is-auth0-affected-by-cve-2026-98432/205097)
**Author:** [@Shinya](https://community.auth0.com/u/Shinya)\ **Replies:** 2\ **Last updated:** [November 9, 2026, 4:47am UTC](https://community.auth0.com/t/is-auth0-affected-by-cve-2026-98432/205097 "2026-11-09T04:47:38Z")
We are currently assessing the potential impact of CVE-2026-98432, a Linux kernel vulnerability, on the services we use. Does anyone know whether Auth0 or its underlying infrastructure is affected by CVE-2026-98432? If… --- ## [Want AI Agents That Don't Spill Secrets? Don't Give Them Secrets](https://community.auth0.com/t/want-ai-agents-that-dont-spill-secrets-dont-give-them-secrets/201173)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [June 26, 2026, 4:53pm UTC](https://community.auth0.com/t/want-ai-agents-that-dont-spill-secrets-dont-give-them-secrets/201173 "2026-06-26T16:53:18Z")
Because LLMs process all context window content equally, any exposed secrets like API keys can be leaked. The golden rule: never grant AI agents access to secrets you must protect. Learn more by reading my latest blog p… --- ## [AI Agents Have Two Souls. You Only Control One](https://community.auth0.com/t/ai-agents-have-two-souls-you-only-control-one/199759)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [May 9, 2026, 7:40am UTC](https://community.auth0.com/t/ai-agents-have-two-souls-you-only-control-one/199759 "2026-05-09T07:40:17Z")
From a security perspective, the code around the LLM matters more than the LLM itself: learn about the two souls of an AI agent. Read more… --- ## [Request for the ability to suppress security alerts triggered by individual end-users/IPs](https://community.auth0.com/t/request-for-the-ability-to-suppress-security-alerts-triggered-by-individual-end-users-ips/199195)
**Author:** [@radu.oprea](https://community.auth0.com/u/radu.oprea)\ **Replies:** 0\ **Last updated:** [April 21, 2026, 10:38pm UTC](https://community.auth0.com/t/request-for-the-ability-to-suppress-security-alerts-triggered-by-individual-end-users-ips/199195 "2026-04-21T22:38:39Z")
Feature: Request for the ability to suppress security alerts triggered by individual end-users/IPs. Description: The current flow of the security alerts is designed to notify the tenant administrators periodically every… --- ## [Feature Request: Ability to Invalidate Auth0 Session Cookies During Signup / Aborted Authentication Flows](https://community.auth0.com/t/feature-request-ability-to-invalidate-auth0-session-cookies-during-signup-aborted-authentication-flows/196373)
**Author:** [@lee.baron](https://community.auth0.com/u/lee.baron)\ **Replies:** 2\ **Last updated:** [March 4, 2026, 4:22pm UTC](https://community.auth0.com/t/feature-request-ability-to-invalidate-auth0-session-cookies-during-signup-aborted-authentication-flows/196373 "2026-03-04T16:22:49Z")
Feature: Ability to Invalidate Auth0 Session Cookies During Signup / Aborted Authentication Flows Description: During Universal Login flows, an Auth0 session cookie (auth0=...) may exist before user creation or before a… --- ## [Add timestamp field to track when user accounts were blocked](https://community.auth0.com/t/add-timestamp-field-to-track-when-user-accounts-were-blocked/196526)
**Author:** [@marko.sidlovsky](https://community.auth0.com/u/marko.sidlovsky)\ **Replies:** 1\ **Last updated:** [February 27, 2026, 7:35pm UTC](https://community.auth0.com/t/add-timestamp-field-to-track-when-user-accounts-were-blocked/196526 "2026-02-27T19:35:38Z")
Feature: Add blocked\_at timestamp field to User Management API Description: The user object currently includes a blocked boolean field but lacks a corresponding timestamp to track when the blocking action occurred. We r… --- ## [Why Broken Access Control Still Dominates the OWASP Top 10 in 2026?](https://community.auth0.com/t/why-broken-access-control-still-dominates-the-owasp-top-10-in-2026/196513)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [January 23, 2026, 9:01am UTC](https://community.auth0.com/t/why-broken-access-control-still-dominates-the-owasp-top-10-in-2026/196513 "2026-01-23T09:01:41Z")
Explore why Broken Access Control remains the #1 OWASP risk in 2026. Learn how to bridge the gap between authentication and authorization using FGA and Policy as Code. --- ## [Demystifying OAuth Security: State vs. Nonce vs. PKCE](https://community.auth0.com/t/demystifying-oauth-security-state-vs-nonce-vs-pkce/195011)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [November 28, 2025, 9:26am UTC](https://community.auth0.com/t/demystifying-oauth-security-state-vs-nonce-vs-pkce/195011 "2025-11-28T09:26:58Z")
Have you ever wondered what the state, nonce, code\_challenge, and code\_verifier parameters are for in OAuth requests? This blog post will provide the answers you are looking for. --- ## [Protect Your Access Tokens with DPoP (Demonstrating Proof of Possession)](https://community.auth0.com/t/protect-your-access-tokens-with-dpop-demonstrating-proof-of-possession/191057)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [August 25, 2025, 7:35am UTC](https://community.auth0.com/t/protect-your-access-tokens-with-dpop-demonstrating-proof-of-possession/191057 "2025-08-25T07:35:55Z")
Did you know you can bind an access token to the client application, improving its security? DPoP allows you to do this. Read more here. --- ## [Ability to disable username/email address autocomplete on signup/login flows](https://community.auth0.com/t/ability-to-disable-username-email-address-autocomplete-on-signup-login-flows/190525)
**Author:** [@sana.rauf](https://community.auth0.com/u/sana.rauf)\ **Replies:** 1\ **Last updated:** [August 29, 2025, 2:05pm UTC](https://community.auth0.com/t/ability-to-disable-username-email-address-autocomplete-on-signup-login-flows/190525 "2025-08-29T14:05:33Z")
Feature: Ability to disable username/email address autocomplete on signup/login flows Description: Our Security team wants us to disable the email/username autocomplete. Use-case: Security requirement --- ## [OAuth 2.0 Access Tokens and the Principle of Least Privilege](https://community.auth0.com/t/oauth-2-0-access-tokens-and-the-principle-of-least-privilege/189310)
**Author:** [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Replies:** 1\ **Last updated:** [July 17, 2025, 10:43am UTC](https://community.auth0.com/t/oauth-2-0-access-tokens-and-the-principle-of-least-privilege/189310 "2025-07-17T10:43:23Z")
How can you apply the Principle of Least Privilege when using OAuth 2.0 access tokens to protect your applications? Learn more through this blog post. --- ## [RFC 7636 violation - Weak enforcement of PKCE parameters in OAuth 2.0 implementation](https://community.auth0.com/t/rfc-7636-violation-weak-enforcement-of-pkce-parameters-in-oauth-2-0-implementation/187016)
**Author:** [@manish.singh](https://community.auth0.com/u/manish.singh)\ **Replies:** 2\ **Last updated:** [July 15, 2025, 8:54am UTC](https://community.auth0.com/t/rfc-7636-violation-weak-enforcement-of-pkce-parameters-in-oauth-2-0-implementation/187016 "2025-07-15T08:54:28Z")
Feature: Strict enforcement of PKCE parameters in OAuth 2.0 implementation Description: PKCE ( Proof Key for Code Exchange) was introduced as an extension to OAuth 2.0 to mitigate risk of authorization code interception… --- ## [Identity: The Critical Link in Retail and Hospitality’s Digital Future](https://community.auth0.com/t/identity-the-critical-link-in-retail-and-hospitality-s-digital-future/186488)
**Author:** [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Replies:** 1\ **Last updated:** [May 8, 2025, 3:00pm UTC](https://community.auth0.com/t/identity-the-critical-link-in-retail-and-hospitality-s-digital-future/186488 "2025-05-08T15:00:05Z")
Why retail and hospitality’s medium and long-term future will belong to brands that modernize customer identity. Read more… :writing\_hand:t2: Brought to you by Bradford Peirce --- ## [Generate More Secure Code With AI-Powered Tools](https://community.auth0.com/t/generate-more-secure-code-with-ai-powered-tools/185652)
**Author:** [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Replies:** 1\ **Last updated:** [April 17, 2025, 9:34pm UTC](https://community.auth0.com/t/generate-more-secure-code-with-ai-powered-tools/185652 "2025-04-17T21:34:07Z")
Essential practices for securing AI-generated code, key security considerations for your full-stack application, deployment, and infrastructure precautions. Read more… :writing\_hand:t2: Brought to you by @dan-auth0 --- ## [Better User Experiences, Stronger Security](https://community.auth0.com/t/better-user-experiences-stronger-security/185225)
**Author:** [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Replies:** 1\ **Last updated:** [April 9, 2025, 3:37pm UTC](https://community.auth0.com/t/better-user-experiences-stronger-security/185225 "2025-04-09T15:37:42Z")
Auth0’s latest features enhance user experience with secure, customizable logins, flexible authentication, and improved security—without compromising convenience. Read more… :writing\_hand:t2: Brought to you by Michelle… --- ## [Designing Apps for Growth: How a Layered Identity Solution Helps You Win](https://community.auth0.com/t/designing-apps-for-growth-how-a-layered-identity-solution-helps-you-win/182853)
**Author:** [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Replies:** 1\ **Last updated:** [February 25, 2025, 8:01pm UTC](https://community.auth0.com/t/designing-apps-for-growth-how-a-layered-identity-solution-helps-you-win/182853 "2025-02-25T20:01:04Z")
Innovative companies are reshaping CX with instant gratification, consistency, and hyper-personalization, raising consumer expectations and market standards. Read more… :writing\_hand:t2: Brought to you by Samantha Murp… --- ## [The Rise of AI Agents and the Security Challenges Ahead](https://community.auth0.com/t/the-rise-of-ai-agents-and-the-security-challenges-ahead/182435)
**Author:** [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Replies:** 1\ **Last updated:** [February 19, 2025, 3:38pm UTC](https://community.auth0.com/t/the-rise-of-ai-agents-and-the-security-challenges-ahead/182435 "2025-02-19T15:38:12Z")
Learn how Auth for GenAI helps secure your GenAI apps. Join the waitlist to be the first to know when Auth for GenAI is available in Developer Preview. Read more… :writing\_hand:t2: Brought to you by Michelle Agroskin … --- ## [Tool Calling in AI Agents: Empowering Intelligent Automation Securely](https://community.auth0.com/t/tool-calling-in-ai-agents-empowering-intelligent-automation-securely/182185)
**Author:** [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Replies:** 1\ **Last updated:** [February 14, 2025, 3:31pm UTC](https://community.auth0.com/t/tool-calling-in-ai-agents-empowering-intelligent-automation-securely/182185 "2025-02-14T15:31:25Z")
Discover how AI agents are taking center stage by seamlessly integrating with multiple digital tools like Gmail, Calendar, Slack, and Google Drive to be more efficient. Learn why it is important to secure them and how to… --- ## [Identity Security 101: How to Drive Trust and Loyalty across the User Journey](https://community.auth0.com/t/identity-security-101-how-to-drive-trust-and-loyalty-across-the-user-journey/182075)
**Author:** [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Replies:** 1\ **Last updated:** [February 12, 2025, 10:28pm UTC](https://community.auth0.com/t/identity-security-101-how-to-drive-trust-and-loyalty-across-the-user-journey/182075 "2025-02-12T22:28:27Z")
If you’re curious about how to stay ahead of increasingly sophisticated attacks without putting your business goals at risk with excessive friction, this resource is for you. Read more… :writing\_hand:t2: Brought to you… --- ## [Block IPv6 range](https://community.auth0.com/t/block-ipv6-range/84445)
**Author:** [@kiwibel](https://community.auth0.com/u/kiwibel)\ **Replies:** 1\ **Last updated:** [November 21, 2024, 6:36pm UTC](https://community.auth0.com/t/block-ipv6-range/84445 "2024-11-21T18:36:22Z")
Hi there! We are seeing multiple signup attempts via Auth0 from a single IPv6 range. Suspicious IP Throttling is enabled but it appears the script has some back-off logic. Also, it is trivial to swap IPv6 addresses. I… --- ## [Can I Skip Verification of Information Encoded in JWTs?](https://community.auth0.com/t/can-i-skip-verification-of-information-encoded-in-jwts/149515)
**Author:** [@bittere](https://community.auth0.com/u/bittere)\ **Replies:** 1\ **Last updated:** [October 11, 2024, 3:39pm UTC](https://community.auth0.com/t/can-i-skip-verification-of-information-encoded-in-jwts/149515 "2024-10-11T15:39:54Z")
I have a little app that uses JWT to make some transactions (on a virtual “currency”, like tokens or points or credits). I don’t need it to be super secure (it’s only going to be online for maybe 6 hours), and adding a d… --- ## [Token from "getAccessTokenSilently" in frontend insecure?](https://community.auth0.com/t/token-from-getaccesstokensilently-in-frontend-insecure/135643)
**Author:** [@manuel.poelzl1](https://community.auth0.com/u/manuel.poelzl1)\ **Replies:** 5\ **Last updated:** [June 7, 2024, 2:46pm UTC](https://community.auth0.com/t/token-from-getaccesstokensilently-in-frontend-insecure/135643 "2024-06-07T14:46:27Z")
Hi! I have a question regarding the “correct” use of the “getAccessTokenSilently” function. As I understand it, I get a token here and it is stored in memory and then read from it when it is needed. I am currently usin… --- ## [Are Auth0 Id's senstive](https://community.auth0.com/t/are-auth0-ids-senstive/71117)
**Author:** [@philip2](https://community.auth0.com/u/philip2)\ **Replies:** 6\ **Last updated:** [February 3, 2023, 1:51am UTC](https://community.auth0.com/t/are-auth0-ids-senstive/71117 "2023-02-03T01:51:05Z")
Hi All, I’m hoping someone can help me with this. Does anyone know if the Auth0 id’s from both email and social connects are “sensitive” currently we’re using them as our userId’s in our API’s and I’m worried that expo… --- ## [Auth0 tenant admin - password policy](https://community.auth0.com/t/auth0-tenant-admin-password-policy/91250)
**Author:** [@dor](https://community.auth0.com/u/dor)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 11:00am UTC](https://community.auth0.com/t/auth0-tenant-admin-password-policy/91250 "2022-09-27T11:00:31Z")
Hi, For compliance reasons, I must force/enable all tenant admins to use MFA with a custom password policy. I didn’t find any place in Auth0 that allows doing so. Is that possible? If so, how? Please note I’m talking … --- ## [Password expiration policy](https://community.auth0.com/t/password-expiration-policy/87419)
**Author:** [@isaac.gontovnik](https://community.auth0.com/u/isaac.gontovnik)\ **Replies:** 1\ **Last updated:** [July 22, 2022, 12:14am UTC](https://community.auth0.com/t/password-expiration-policy/87419 "2022-07-22T00:14:23Z")
It will be great to have a password expiration policy feature at Auth0. Best, --- ## [NextJs Cookie lifetime - Security concerns?](https://community.auth0.com/t/nextjs-cookie-lifetime-security-concerns/86749)
**Author:** [@theo.camboulive](https://community.auth0.com/u/theo.camboulive)\ **Replies:** 2\ **Last updated:** [July 12, 2022, 10:56am UTC](https://community.auth0.com/t/nextjs-cookie-lifetime-security-concerns/86749 "2022-07-12T10:56:36Z")
Quick question: We are thinking to increase the Auth Cookie lifetime to 14 days instead of 1 as default. Is that something you would advise against security wise? Why do we need to do this? When a user comes back to our… --- ## [What are the possible attacks if someone able acquire all the organization ids](https://community.auth0.com/t/what-are-the-possible-attacks-if-someone-able-acquire-all-the-organization-ids/83523)
**Author:** [@ruwan-gee](https://community.auth0.com/u/ruwan-gee)\ **Replies:** 1\ **Last updated:** [May 17, 2022, 12:04am UTC](https://community.auth0.com/t/what-are-the-possible-attacks-if-someone-able-acquire-all-the-organization-ids/83523 "2022-05-17T00:04:13Z")
Hi all, Thanks for this nice community, I have following question. We are planning to expose public and open service, which can retrieve Auth0 organization id (e.g: org\_JYONr9aEzpCJxxxx) based on the user’s email addr… --- ## [Subscribe to security bulletins](https://community.auth0.com/t/subscribe-to-security-bulletins/79422)
**Author:** [@lee.omara](https://community.auth0.com/u/lee.omara)\ **Replies:** 3\ **Last updated:** [April 11, 2022, 10:43pm UTC](https://community.auth0.com/t/subscribe-to-security-bulletins/79422 "2022-04-11T22:43:22Z")
Hello there, I’m interested in monitoring Auth0 security bulletins. Is there a mailing list, RSS feed or other mechanism to get notified when new security bulletins are published? I see that Security Bulletins are post… --- ## [The 11 Biggest Data Breaches of 2020 (So Far)](https://community.auth0.com/t/the-11-biggest-data-breaches-of-2020-so-far/45634)
**Author:** [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Replies:** 1\ **Last updated:** [July 1, 2020, 5:23pm UTC](https://community.auth0.com/t/the-11-biggest-data-breaches-of-2020-so-far/45634 "2020-07-01T17:23:37Z")
The trends defining the year and how businesses can protect themselves. We’ve reached the halfway mark of 2020, so it’s a good time to take a look at the biggest data breaches of the year so far. Read more Brought for… --- ## [Data Privacy vs. Data Security: Why Your Business Needs Both](https://community.auth0.com/t/data-privacy-vs-data-security-why-your-business-needs-both/45317)
**Author:** [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Replies:** 1\ **Last updated:** [June 26, 2020, 7:07am UTC](https://community.auth0.com/t/data-privacy-vs-data-security-why-your-business-needs-both/45317 "2020-06-26T07:07:07Z")
If you secretly read your friend’s journal to find out their secrets, you’ve violated the principles of data privacy. But if your friend tells you their secrets, and you write it in your own journal, and then leave that … [Next page](https://community.auth0.com/tag/security/285.md?match_all_tags=true&page=1&tags%5B%5D=security)