CVE-2020-15125

CVE-2020-15125 concerns the npm package auth0 and affects versions before 2.27.1. A denylist of keys sanitized from the request object in the error object does not include the Authorization header, enabling the header value to be logged and potentially exposing a bearer token when using a Machine...

PT-2020-14205

Name of the Vulnerable Software and Affected Versions auth0 versions prior to 2.27.1 Description The issue arises from the lack of sanitization of the Authorization header key in the error object, potentially exposing a bearer token when a request to the Auth0 management API fails. This affects...

CVE-2020-15125: Generation of Error Message Containing Sensitive Information

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...

Auth0 express-jwt Authorization Issues Vulnerability

Auth0 express-jwt is a package that supports authentication of JWT JSON Web tokens via the jsonwebtoken module from Auth0 USA. An authorization issue vulnerability exists in Auth0 express-jwt version 5.3.3 and earlier NPM package, which can be exploited by an attacker to bypass authorization with...

Information Disclosure

auth0.js is vulnerable to information disclosure. Error objects are returned by the library containing confidential information such as the original request of the user or the plaintext password entered by the user...

@apim/auth0-lock-redux (>=1.0.0, <=1.0.2), @auth0/cordova (>=0.1.0, <=0.2.0) +111 more potentially affected by CVE-2020-5263 via auth0-js (>=8.0.0-beta.1, <=9.13.1)

auth0-js NPM version =8.0.0-beta.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.1.0, =0.1.0-latest.1a450bb3, =1.4.5-next.1, =2.2.0, =1.0.0, =0.1.0, =0.3.0, =0.8.0 and more Source cves: CVE-2020-5263 Source advisory: OSV:GHSA-PRFQ-F66G-43MP...

Information disclosure through error object in auth0.js

Overview Between versions 8.0.0 and 9.13.1inclusive, in the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification...

GHSA-PRFQ-F66G-43MP Information disclosure through error object in auth0.js

Overview Between versions 8.0.0 and 9.13.1inclusive, in the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification...

auth0.js Information Disclosure Vulnerability

auth0.js is a client-side JavaScript toolkit for the Auth0 API Application Programming Interface. A security vulnerability exists in auth0.js NPM package auth0-js versions 8.0.0 through 9.13.1. An attacker can exploit the vulnerability to obtain a password...

CVE-2020-5263

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

CVE-2020-5263

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

Design/Logic Flaw

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

CVE-2020-5263

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

CVE-2020-5263

The CVE-2020-5263 entry concerns the Auth0.js (NPM package auth0-js) library. Affected versions are greater than 8.0.0 and before 9.12.3, where an authentication error returns an error object that may contain the user’s original request, potentially exposing the plaintext password if logged or ex...

CVE-2020-5263 Information disclosure through error object

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

PT-2020-18354

Name of the Vulnerable Software and Affected Versions auth0.js versions 8.0.0 through 9.12.3 auth0.js versions 8.0.0 through 9.13.1 Description In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plainte...

CVE-2020-5263: Insufficiently Protected Credentials

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

WordPress Auth0 Insecure Direct Object Reference Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress Auth0 versions prior to 4.0.0. The vulnerability can be exploited...

WordPress CSV Injection Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An injection vulnerability exists in WordPress Auth0 prior to version 4.0.0, which results from the program no...

WordPress Auth0 Cross-Site Scripting Vulnerability (CNVD-2020-33761)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Auth0 versions prior to 4.0.0. The vulnerability stem...