Read the docs
TI-2020-04319 Aliases CVE-2020-5263GHSA-prfq-f66g-43mp

Information disclosure through error object

Priority LOW 26CWE-522Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-522.

Summary

auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification, the application risks password exposure. This is fixed in version 9.12.3

Why it matters now

EPSS 0.00871 59th percentileScored 2026-11-07
Fix Fixed auth0.js (auth0): 9.12.3auth0-js (npm): 9.13.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
auth0auth0.js8.0.0 to before 9.12.39.12.3Patch availableCNA
—auth0-js (npm)8.0.0 to before 9.13.29.13.2Patch availableGHSA-prfq-f66g-43mp
  • auth0.js Vendorauth0 Affected 8.0.0 to before 9.12.3 Fixed in 9.12.3 Patch available CNA
  • auth0-js (npm) Vendor— Affected 8.0.0 to before 9.13.2 Fixed in 9.13.2 Patch available GHSA-prfq-f66g-43mp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:auth0:auth0.js:*:*:*:*:*:*:*:*8.0.0 – 9.13.1Vulnerableauth0
  • cpe:2.3:a:auth0:auth0.js:*:*:*:*:*:*:*:* Versions 8.0.0 – 9.13.1 Vulnerable ·auth0

Remediation

  • Fix · CNA auth0.js (auth0) Fixed in 9.12.3
  • Fix · GHSA-prfq-f66g-43mp auth0-js (npm) Fixed in 9.13.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5263
  2. 2026-10-03 Alias added: GHSA-prfq-f66g-43mp

References

Patch 1

Advisory 2

  • TI-2018-05020 The Auth0 authentication service before 2017-10-15 allows privilege escalation because… CVSS 3.0CRITICAL 9.8
  • TI-2018-05300 The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the… CVSS 3.0HIGH 8.8
  • TI-2018-05021 CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. CVSS 3.0HIGH 8.8
  • TI-2020-11898 Authorization header is not sanitized in an error object in auth0 CVSS 3.1HIGH 7.7
  • TI-2017-12531 A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting… CVSS 3.0HIGH 7.5
  • TI-2026-30591 Improper Permission Checking in Auth.js SDK CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences