CVE-2020-5263 - CVE House
Back to Database
Status published Medium CVE-2020-5263

Information disclosure through error object

Vulnerability Description

auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification, the application risks password exposure. This is fixed in version 9.12.3

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-5263

Credits & Attribution

No credits recorded in the NVD database.

References

More from auth0

View All →
CVE-2025-68129
Auth0-PHP SDK has Improper Audience Validation
Medium 6.8
CVE-2025-67716
Auth0 Next.js SDK has Improper Validation of Query Parameters
Medium 5.7
CVE-2025-67490
Auth0 Next.js SDK has Improper Request Caching Lookup
Medium 5.4
CVE-2025-65945
auth0/node-jws improper HMAC signature verification vulnerability
High 7.5
CVE-2025-58769
auth0-PHP: Improper File Type Handling in Bulk User Import
Low 3.3

Affected Vendor

Affected Software

auth0.js
Vulnerable Versions:
>= 8.0.0, < 9.12.3

Timeline

Official Publish: April 9th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-522

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1555 Credentials from Password Stores
Credential Access
T1078 Valid Accounts
Persistence
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Privilege Escalation