The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This flaw allows a user with low privileges on the host to modify the connector's configuration files. When the service restarts, the altered configuration can result in the execution of arbitrary code running with the privileges of the connector service account.

All versions of Auth0 AD/LDAP Connector prior to 7.00 are affected. The vulnerability is present in the Auth0 AD and LDAP connector product used by organizations integrating Auth0 with on‑premises Active Directory or LDAP directories.

The CVSS score of 7.8 indicates a high severity for local privilege escalation. With a low‑privileged local user able to change configuration files, an attacker can gain execution rights matching the connector service account. No exploit probability score is published, and the vulnerability is not yet catalogued in CISA’s KEV list. The attack requires local access and the ability to restart the service; thus, denial of service or code execution at the service account level is the likely impact.