High severity · published Jul 29, 2020
CVE-2020-15125
In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used
7.7
CVSS
1.5%
EPSS
No
On KEV
Description
In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer token. You are affected by this vulnerability if you are using the auth0 npm package, and you are using a Machine to Machine application authorized to use Auth0's management API
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
Auth0.js · Auth0
before 2.27.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15125
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15125
Patch
https://github.com/auth0/node-auth0/pull/507
Patch
https://github.com/auth0/node-auth0/pull/507/commits/62ca61b3348ec8e74d7d00358661af1a8bc98a3c
Third Party Advisory
https://github.com/auth0/node-auth0/security/advisories/GHSA-5jpf-pj32-xx53
Release Notes
https://github.com/auth0/node-auth0/tree/v2.27.1
More from Auth0.js
9.8
CVE-2018-6873
The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated
8.8
CVE-2018-6874
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled
8.8
CVE-2018-7307
The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter
7.5
CVE-2017-17068
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12
7.1
CVE-2026-42280
Improper Permission Checking in Auth.js SDK