Explore the latest Auth0 updates, trends, and security insights to safeguard your digital assets and identity management systems. Stay secure with Auth0 news.
Search across headline titles and summaries.
Background for this topic.
Auth0 is a cloud identity platform for adding authentication and authorization to applications and APIs. It brokers logins through standards such as OAuth 2.0, OpenID Connect, and SAML, and can connect local accounts with enterprise or social identity providers. It issues tokens and manages sessions, multifactor authentication, user enrollment, and account recovery.
Its security depends heavily on tenant configuration and the applications consuming its tokens. Overly broad redirect URIs, scopes, or token audiences can enable account or API access, while weak recovery flows or poorly enforced MFA can undermine otherwise strong authentication. A compromised administrator account, signing key, custom action, or integration may affect multiple connected applications. Defenders should restrict administrative access, validate issuer, audience, signature, and expiry claims, rotate and protect keys, monitor authentication and administrative logs, and test recovery paths. Because Auth0 centralizes identity attributes and login events, retention, access controls, and incident procedures for that data also require careful management.
Weekly headline count for the current query.
Okta has open-sourced ready-made Sigma-based queries for Auth0 customers to detect account takeovers, misconfigurations, and suspicious behavior in event logs. [...]
Okta has open-sourced ready-made Sigma-based queries for Auth0 customers to detect account takeovers, misconfigurations, and suspicious behavior in event logs. [...]
Auth0 fixed a remote code execution vulnerability in the immensely popular 'JsonWebToken' open-source library used by over 22,000 projects and downloaded over 36 million times per month on NPM. [...]
Authentication service provider and Okta subsidiary Auth0 has disclosed what it calls a "security event" involving some of its code repositories. [...]