{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-126129","sourceIdentifier":"psirt@okta.com","published":"2026-11-10T22:18:31.733","lastModified":"2026-11-10T22:18:31.733","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints."}],"affected":[{"source":"psirt@okta.com","affectedData":[{"vendor":"Auth0","product":"Auth0 ASP.NET Core Authentication","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.12.0","versionType":"semver","status":"affected"}]}]}],"metrics":{},"weaknesses":[{"source":"psirt@okta.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-807"},{"lang":"en","value":"CWE-1254"}]}],"references":[{"url":"https://trust.okta.com/security-advisories/improper-backchannel-session-revocation-in-the-auth0-asp-net-core-authentication-sdk-cve-2026-126129","source":"psirt@okta.com"}]}}