Vulnerability record · CVE-2020-5263 · published 9 April 2020

CVE-2020-5263: Auth0.js insufficiently protected credentials vulnerability

Auth0 · Auth0.Js

auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification, the application risks password exposure. This is fixed in version 9.12.3

4.9 CVSS 3.1 Medium EPSS 0.87% · top 42.8% CWE-522 · Insufficiently protected credentials

4.9CVSS 3.1 base score, v2 4.0

0.87%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Auth0.Js Auth0

References

Link	Tags
https://github.com/auth0/auth0.js/commit/355ca749b229fb93142f0b3978399b248d710828	PatchThird Party Advisory
https://github.com/auth0/auth0.js/security/advisories/GHSA-prfq-f66g-43mp	Third Party Advisory
https://github.com/auth0/auth0.js/commit/355ca749b229fb93142f0b3978399b248d710828	PatchThird Party Advisory
https://github.com/auth0/auth0.js/security/advisories/GHSA-prfq-f66g-43mp	Third Party Advisory

Track CVE-2020-5263 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-6873Auth0.js improper authentication vulnerabilityThe Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated.EPSS 2.2%4 Apr 2018 8.8CVE-2018-6874Auth0.js cross-site request forgery vulnerabilityCSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.EPSS 0.74%4 Apr 2018 8.8CVE-2018-7307Auth0.js cross-site request forgery vulnerabilityThe Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter.EPSS 0.51%6 Mar 2018 7.7CVE-2020-15125Auth0.js error message information leak vulnerabilityIn auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error ob…EPSS 1.5%29 Jul 2020 7.5CVE-2017-17068Auth0.js information exposure vulnerabilityA cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to ac…EPSS 1.4%6 Dec 2017 7.1CVE-2026-42280Auth0.js incorrect authorization vulnerabilityAuth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return u…EPSS 0.29%27 May 2026 9.8CVE-2021-22681Rockwell Logix Designer authentication bypass via weak key verificationRockwell Automation Studio 5000 Logix Designer (v21+) and RSLogix 5000 (v16-20) rely on a key to verify that Logix controllers are talking to genuine…KEVEPSS 64%analysed3 Mar 2021 9.8CVE-2021-30116Kaseya VSA credential disclosure via unauthenticated download pageKaseya VSA before 9.5.7 exposes an unauthenticated download page (dl.asp) that leaks agent credentials and accepts them via GET request. An attacker …KEVEPSS 86%analysed9 Jul 2021

Source: NIST National Vulnerability Database (record CVE-2020-5263), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.