Description
Between versions 8.0.0 and 9.13.1(inclusive), in the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered.
If the error object is exposed or logged without modification, the application risks password exposure.
Recommendation
Update the auth0-js package to the latest compatible version. Followings are version details:
- Affected version(s): >= 8.0.0, < 9.13.2
- Patched version(s): 9.13.2
References
Could your website be exposed too?
SmartScanner can check your website for Information disclosure through error object in auth0.js and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting sid - CVE-2026-39412
- Generation of Error Message Containing Sensitive Information in zsa - CVE-2024-37162
- Auth0-js bypasses CSRF checks - CVE-2018-7307
- Cross-Site Request Forgery (CSRF) in Auth0 - CVE-2018-6874
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023