Auth0 third-party & OAuth apps security checks
OAuth grants, marketplace apps, integrations, plugins and automations with standing access to company data — the SaaS-to-SaaS supply chain.
On Auth0, Black Cat runs 3 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Auth0 connector needs.
Checks (3)
severity: high Application Risky Grant Type fix difficulty: medium #
Remove ROPC (password) and implicit grant types from applications
- Open Auth0 Dashboard > Applications and select the flagged application
- Open Advanced Settings > Grant Types
- Remove the Password (ROPC) and Implicit grant types
- Migrate the app to Authorization Code with PKCE
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12
severity: high Public Client With Confidential Grant fix difficulty: medium #
Add client authentication to applications using confidential grants
- Open Auth0 Dashboard > Applications and select the flagged application
- Set Token Endpoint Authentication Method to a client-secret method
- Remove client_credentials from a public (SPA/native) app if it should not have it
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12
severity: medium Wildcard Callback URL fix difficulty: easy #
Replace wildcard and insecure callback/origin URLs with exact HTTPS URLs
- Open Auth0 Dashboard > Applications and select the flagged application
- In Application URIs, replace wildcard (*) and non-localhost http:// entries with exact https:// URLs
- Save and verify the login flow still works
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-9.12