CVE-2022-29172

CVE-2022-29172 is a medium-severity vulnerability affecting Auth0 Lock versions prior to 11.33.0 when the "additional signup fields" feature is enabled. An unauthenticated attacker can inject malicious HTML into these fields, which is then stored in user metadata and rendered in verification emails, potentially leading to crafted malicious links. The CVSS score is 6.1, indicating a network-based attack with low complexity, requiring user interaction, and resulting in low confidentiality and integrity impacts. There is no evidence of active exploitation, public exploit code, or significant community discussion regarding this vulnerability.