# \#vulnerability
**URL:** https://community.auth0.com/tag/vulnerability/685.md
[Latest](https://community.auth0.com/latest.md) · [Categories](https://community.auth0.com/categories.md) · [Tags](https://community.auth0.com/tags.md)
---
## [Cookie “HTTPOnly” and “secure” attribute vulnerability](https://community.auth0.com/t/cookie-httponly-and-secure-attribute-vulnerability/85024)
**Author:** [@coskucinkilic](https://community.auth0.com/u/coskucinkilic)\
**Replies:** 1\
**Last updated:** [June 14, 2022, 12:18am UTC](https://community.auth0.com/t/cookie-httponly-and-secure-attribute-vulnerability/85024 "2022-06-14T00:18:10Z")
Hello, When I scan my Frontend Page with “Qualys API SCAN” software that is intended to find vulnerabilities, it lands on AUTH0 page and it finds 2 problems with the cookies: Session Cookie (Authentication Related) Doe…
---
## [What are the possible attacks if someone able acquire all the organization ids](https://community.auth0.com/t/what-are-the-possible-attacks-if-someone-able-acquire-all-the-organization-ids/83523)
**Author:** [@ruwan-gee](https://community.auth0.com/u/ruwan-gee)\
**Replies:** 1\
**Last updated:** [May 17, 2022, 12:04am UTC](https://community.auth0.com/t/what-are-the-possible-attacks-if-someone-able-acquire-all-the-organization-ids/83523 "2022-05-17T00:04:13Z")
Hi all, Thanks for this nice community, I have following question. We are planning to expose public and open service, which can retrieve Auth0 organization id (e.g: org\_JYONr9aEzpCJxxxx) based on the user’s email addr…
---
## [Cookie "HTTPOnly" and "secure" attribute vulnerability](https://community.auth0.com/t/cookie-httponly-and-secure-attribute-vulnerability/77868)
**Author:** [@andreinechifor83](https://community.auth0.com/u/andreinechifor83)\
**Replies:** 1\
**Last updated:** [February 22, 2022, 11:24pm UTC](https://community.auth0.com/t/cookie-httponly-and-secure-attribute-vulnerability/77868 "2022-02-22T23:24:29Z")
Hello, When I scan my Frontend Page with “Qualys API SCAN” software that is intended to find vulnerabilities, it lands on AUTH0 authentification page. And it finds 2 problems with the cookies: Cookie Does Not Contain T…
---
## ["alt": "none" validation bug on jwt.io](https://community.auth0.com/t/alt-none-validation-bug-on-jwt-io/7210)
**Author:** [@ra\_hardy](https://community.auth0.com/u/ra_hardy)\
**Replies:** 1\
**Last updated:** [June 23, 2017, 10:02am UTC](https://community.auth0.com/t/alt-none-validation-bug-on-jwt-io/7210 "2017-06-23T10:02:19Z")
On https://jwt.io/, if I change “alg”: “HS256” to “alg”: “none”, then the signature still passes validation. I can then change the body contents at will. This seems to be the very bug that the blog post in the warning o…