CVE-2020-15125 - CVE House
Back to Database
Status published High CVE-2020-15125

Authorization header is not sanitized in an error object in auth0

Vulnerability Description

In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer token. You are affected by this vulnerability if you are using the auth0 npm package, and you are using a Machine to Machine application authorized to use Auth0's management API

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15125

Credits & Attribution

No credits recorded in the NVD database.

References

More from auth0

View All →
CVE-2025-68129
Auth0-PHP SDK has Improper Audience Validation
Medium 6.8
CVE-2025-67716
Auth0 Next.js SDK has Improper Validation of Query Parameters
Medium 5.7
CVE-2025-67490
Auth0 Next.js SDK has Improper Request Caching Lookup
Medium 5.4
CVE-2025-65945
auth0/node-jws improper HMAC signature verification vulnerability
High 7.5
CVE-2025-58769
auth0-PHP: Improper File Type Handling in Bulk User Import
Low 3.3

Affected Vendor

Affected Software

node-auth0
Vulnerable Versions:
< 2.27.1

Timeline

Official Publish: July 29th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-209

MITRE ATT&CK TTPs

T1592 Gather Victim Host Information
Reconnaissance
T1083 File and Directory Discovery
Discovery
T1552 Unsecured Credentials
Credential Access
T1212 Exploitation for Defense Evasion
Defense Evasion
T1005 Data from Local System
Collection