Read the docs
TI-2020-11898 Aliases CVE-2020-15125GHSA-5jpf-pj32-xx53

Authorization header is not sanitized in an error object in auth0

Priority LOW 37CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-209.

Summary

In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer token. You are affected by this vulnerability if you are using the auth0 npm package, and you are using a Machine to Machine application authorized to use Auth0's management API

Why it matters now

EPSS 0.01539 75th percentileScored 2026-11-07
Fix Fixed node-auth0 (auth0): 2.27.1auth0 (npm): 2.27.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
auth0node-auth0before 2.27.12.27.1Patch availableCNA
—auth0 (npm)before 2.27.12.27.1Patch availableGHSA-5jpf-pj32-xx53
  • node-auth0 Vendorauth0 Affected before 2.27.1 Fixed in 2.27.1 Patch available CNA
  • auth0 (npm) Vendor— Affected before 2.27.1 Fixed in 2.27.1 Patch available GHSA-5jpf-pj32-xx53

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:auth0:auth0.js:*:*:*:*:*:*:*:*before 2.27.1Vulnerableauth0
  • cpe:2.3:a:auth0:auth0.js:*:*:*:*:*:*:*:* Versions before 2.27.1 Vulnerable ·auth0

Remediation

  • Fix · CNA node-auth0 (auth0) Fixed in 2.27.1
  • Fix · GHSA-5jpf-pj32-xx53 auth0 (npm) Fixed in 2.27.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15125
  2. 2026-10-03 Alias added: GHSA-5jpf-pj32-xx53

References

Patch 2

Advisory 3

  • TI-2018-05020 The Auth0 authentication service before 2017-10-15 allows privilege escalation because… CVSS 3.0CRITICAL 9.8
  • TI-2018-05300 The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the… CVSS 3.0HIGH 8.8
  • TI-2018-05021 CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. CVSS 3.0HIGH 8.8
  • TI-2017-12531 A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting… CVSS 3.0HIGH 7.5
  • TI-2026-30591 Improper Permission Checking in Auth.js SDK CVSS 3.1HIGH 7.1
  • TI-2020-04319 Information disclosure through error object CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences