CVE-2020-15125— Authorization header is not sanitized in an error object in auth0
Quick assessment
Affected
auth0 node-auth0
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Auth0 node-auth0是美国Auth0公司的一款Auth0平台的Node.js客户端库。 Auth0 node-auth0 2.27.1之前版本中存在安全漏洞，该漏洞源于程序没有清除Authorization标头的密钥。攻击者可利用该漏洞泄露令牌信息。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-15125
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authorization header is not sanitized in an error object in auth0
Source: CVE Program / CVE List V5
Vulnerability Description
In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer token. You are affected by this vulnerability if you are using the auth0 npm package, and you are using a Machine to Machine application authorized to use Auth0's management API
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过错误消息导致的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Auth0 node-auth0 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Auth0 node-auth0是美国Auth0公司的一款Auth0平台的Node.js客户端库。 Auth0 node-auth0 2.27.1之前版本中存在安全漏洞，该漏洞源于程序没有清除Authorization标头的密钥。攻击者可利用该漏洞泄露令牌信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| auth0 | node-auth0 | < 2.27.1 | - |
|
II. Public POCs for CVE-2020-15125
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-15125
请登录查看更多情报信息。
Patches & Fixes for CVE-2020-15125 (2)
-
https://github.com/auth0/node-auth0/pull/507 x_refsource_MISC
Vendor Advisories for CVE-2020-15125 (1)
-
https://github.com/auth0/node-auth0/security/advisories/GHSA-5jpf-pj32-xx53 x_refsource_CONFIRM
Other References for CVE-2020-15125 (1)
-
https://github.com/auth0/node-auth0/tree/v2.27.1 x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: auth0
-
CVE-2026-50157
Auth0 Symfony: Bearer Token Accepted via URL Query Parameter -
CVE-2026-84685
Improper Cache Isolation in auth0/react-native-auth0 SDK Web -
CVE-2026-85983
Local Privilege Escalation in Auth0 AD/LDAP Connector -
CVE-2026-85982
Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector -
CVE-2026-85981
Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Conne
Same weakness: CWE-209
-
CVE-2026-75597
pyLoad: Unauthenticated access to /web/<path:filename> bypas -
CVE-2026-78021
Dell Secure Connect Gateway <5.34.00.16 敏感信息泄露漏洞 -
CVE-2026-105828
Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclos -
CVE-2026-101029
Gitea migration and pull mirror SSRF through multi-answer DN -
CVE-2026-105707
uptrace user_handler.go Login information exposure
V. Comments for CVE-2020-15125
No comments yet