The flaw causes auth0‑lock to send username information for domain‑only Active Directory accounts in a GET request, appending the data as URL parameters. These parameters can appear in server logs, browser history, or proxy traces, exposing credentials or other sensitive information. The weakness is cataloged as improper log handling (CWE‑532) and improper input validation (CWE‑598).

The vulnerability affects the Auth0 auth0‑lock library used in web applications. Earlier releases older than 13.2.1 or 15.0.2 are impacted. When integrated with Active Directory, any username that is a bare domain triggers the improper GET behavior.

The CVSS score of 5.3 categorizes the risk as medium, and an EPSS score of less than 1% indicates a low likelihood of exploitation. Because the attack requires a client to provide a domain‑only username during authentication, it is a passive data capture scenario rather than an active exploit. The vulnerability is not listed in the CISA KEV catalog. An attacker could extract credentials from logs or URL traces but would not gain code execution or privilege escalation.