Executive brief
Auth0.js is a JavaScript library used by developers to add authentication to web applications. In versions 8.0.0 through 9.13.1, authentication error messages inadvertently included users' plaintext passwords. If these error objects are logged, displayed, or stored by the application, attackers who gain access to logs or error reports could steal user credentials and compromise accounts.
Technical details
This vulnerability is an information disclosure flaw (CWE-522) in the auth0.js library's error handling. When authentication fails, the error object returned by the library contains the original user request, including any plaintext passwords entered by the user. The vulnerability affects versions 8.0.0 through 9.13.1 and has no special preconditions beyond using an affected version and storing/displaying the error object without sanitization. An attacker who can access application logs, error reports, or error messages displayed to administrators can extract plaintext passwords from the error objects. The fix was released in version 9.13.2, which masks user-entered passwords in error objects.
Affected products
- Auth0 auth0.js 8.0.0 to 9.13.1
Timeline
- 2020-04-09: disclosed
- 2020-04-10: patched: Version 9.13.2 released with password masking in error objects