# CVE-2020-5263: Auth0 auth0.js information disclosure in error object

Source: https://junglewise.ai/threats/cve-2020-5263-auth0-auth0-js-information-disclosure-in-error-object  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-04-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-5263 · Severity: low · CVSS 3.1 · Published 2020-04-10

Auth0.js is a JavaScript library used by developers to add authentication to web applications. In versions 8.0.0 through 9.13.1, authentication error messages inadvertently included users' plaintext passwords. If these error objects are logged, displayed, or stored by the application, attackers who gain access to logs or error reports could steal user credentials and compromise accounts.

Technologies: [auth0-js (npm)](https://junglewise.ai/threats/technologies/auth0-js). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-5263 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-5263 being exploited in the wild.

**How severe is CVE-2020-5263?** Low severity, with a CVSS score of 3.1, published 10 April 2020.

**Which products and versions are affected?** auth0-js (npm) SEMVER:introduced=8.0.0,fixed=9.13.2.

**Is there a fix for CVE-2020-5263?** Yes. auth0-js (npm): upgrade to 9.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-5263 attacked?** It is attacked with local access.

**Am I affected by CVE-2020-5263?** Check whether you run auth0-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- auth0-js (npm): upgrade to 9.13.2 or later

  ```sh
  npm install auth0-js@9.13.2
  ```


## Technical details

This vulnerability is an information disclosure flaw (CWE-522) in the auth0.js library's error handling. When authentication fails, the error object returned by the library contains the original user request, including any plaintext passwords entered by the user. The vulnerability affects versions 8.0.0 through 9.13.1 and has no special preconditions beyond using an affected version and storing/displaying the error object without sanitization. An attacker who can access application logs, error reports, or error messages displayed to administrators can extract plaintext passwords from the error objects. The fix was released in version 9.13.2, which masks user-entered passwords in error objects.

## Affected products

- Auth0 auth0.js 8.0.0 to 9.13.1

## Identifiers

- CVE-2020-5263
- GHSA-prfq-f66g-43mp

## Timeline

- 2020-04-09: disclosed
- 2020-04-10: patched: Version 9.13.2 released with password masking in error objects

## References

- [https://github.com/auth0/auth0.js/security/advisories/GHSA-prfq-f66g-43mp](https://github.com/auth0/auth0.js/security/advisories/GHSA-prfq-f66g-43mp)

## Related threats

- [Auth0 Auth0.js incorrect authorization in user profile retrieval](https://junglewise.ai/threats/cve-2026-42280-auth0-auth0-js-incorrect-authorization-in-user-profile-retrieval)
- [Auth0 auth0-js Cross-Site Request Forgery in Legacy Lock API](https://junglewise.ai/threats/cve-2018-6874-auth0-auth0-js-cross-site-request-forgery-in-legacy-lock-api)
- [Auth0 auth0-js CSRF bypass in state parameter validation](https://junglewise.ai/threats/cve-2018-7307-auth0-auth0-js-csrf-bypass-in-state-parameter-validation)
- [Auth0 auth0-js cross-origin token disclosure in popup callback](https://junglewise.ai/threats/cve-2017-17068-auth0-auth0-js-cross-origin-token-disclosure-in-popup-callback)