Information Disclosure

auth0 is vulnerable to information disclosure. When Auth0's management API is used to a Machine to Machine application authorization, it does not sanitize DenyList of specific key in the Authorization header and logs Authorization header value, exposing a bearer tokens...

CVE-2020-15125

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...

CVE-2020-15125

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...

CVE-2020-15125

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...

Authorization

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...

Information Exposure

Overview Versions of auth0 before 2.27.1 use a block list of specific keys that should be sanitized from the request object contained in the error object. When a request to Auth0 management API fails, the key for Authorization header is not sanitized and the Authorization header value can be logg...

GHSA-5JPF-PJ32-XX53 Authorization header is not sanitized in an error object in auth0

Overview Versions before and including 2.27.0 use a block list of specific keys that should be sanitized from the request object contained in the error object. When a request to Auth0 management API fails, the key for Authorization header is not sanitized and the Authorization header value can be...

@architect-io/cli (>=0.3.13, <=0.5.2-rc.7), @bagevent/taro-component (1.0.0) +33 more potentially affected by CVE-2020-15125 via auth0 (>=2.0.0-alpha.6, <=2.25.1)

auth0 NPM version =2.0.0-alpha.6, =0.3.13, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.1.0, =4.0.0, =0.0.23, =1.8.0, =0.0.34, =0.0.1, =0.0.34, =3.1.0, =4.0.0 and more Source cves: CVE-2020-15125 Source advisory: OSV:GHSA-5JPF-PJ32-XX53...

Authorization header is not sanitized in an error object in auth0

Overview Versions before and including 2.27.0 use a block list of specific keys that should be sanitized from the request object contained in the error object. When a request to Auth0 management API fails, the key for Authorization header is not sanitized and the Authorization header value can be...

CVE-2020-15125 Authorization header is not sanitized in an error object in auth0

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...

CVE-2020-15125

CVE-2020-15125 concerns the npm package auth0 and affects versions before 2.27.1. A denylist of keys sanitized from the request object in the error object does not include the Authorization header, enabling the header value to be logged and potentially exposing a bearer token when using a Machine...

CVE-2020-15125: Generation of Error Message Containing Sensitive Information

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...

Auth0 express-jwt Authorization Issues Vulnerability

Auth0 express-jwt is a package that supports authentication of JWT JSON Web tokens via the jsonwebtoken module from Auth0 USA. An authorization issue vulnerability exists in Auth0 express-jwt version 5.3.3 and earlier NPM package, which can be exploited by an attacker to bypass authorization with...

Information Disclosure

auth0.js is vulnerable to information disclosure. Error objects are returned by the library containing confidential information such as the original request of the user or the plaintext password entered by the user...

Information disclosure through error object in auth0.js

Overview Between versions 8.0.0 and 9.13.1inclusive, in the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification...

@apim/auth0-lock-redux (>=1.0.0, <=1.0.2), @auth0/cordova (>=0.1.0, <=0.2.0) +111 more potentially affected by CVE-2020-5263 via auth0-js (>=8.0.0-beta.1, <=9.13.1)

auth0-js NPM version =8.0.0-beta.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.1.0, =0.1.0-latest.1a450bb3, =1.4.5-next.1, =2.2.0, =1.0.0, =0.1.0, =0.3.0, =0.8.0 and more Source cves: CVE-2020-5263 Source advisory: OSV:GHSA-PRFQ-F66G-43MP...

GHSA-PRFQ-F66G-43MP Information disclosure through error object in auth0.js

Overview Between versions 8.0.0 and 9.13.1inclusive, in the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification...

auth0.js Information Disclosure Vulnerability

auth0.js is a client-side JavaScript toolkit for the Auth0 API Application Programming Interface. A security vulnerability exists in auth0.js NPM package auth0-js versions 8.0.0 through 9.13.1. An attacker can exploit the vulnerability to obtain a password...

CVE-2020-5263

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

CVE-2020-5263

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...