Repository navigation
onLogin() silently discards Auth0 error responses #964
Description
Checklist
- I have looked into the Readme and the documentation, and have not found a suitable solution or answer.
- I have searched the issues and have not found a suitable solution or answer.
- I have searched the Auth0 Community forums and have not found a suitable solution or answer.
- I agree to the terms within the Auth0 Code of Conduct.
Description
When Auth0 returns an error/error_description on the login callback (expired password, breached-password block, blocked account, etc.), onLogin() redirects to / and exits with no message shown. v4's equivalent (WP_Auth0_LoginManager::die_on_login()) displayed "There was a problem with your log in: {description} [error code: {code}]".
Expected: some indication is shown to the user that login failed and why.
Reproduction
- Trigger any Auth0-side login error (e.g. visit
wp-login.php?error=access_denied&error_description=test&state=<valid-state>, or trigger a real rejection like a blocked/breached-password account). - Observe the browser is redirected to
/with no error message, indistinguishable from a no-op.
Additional context
// line ~545-548
if (null !== $error) {
wp_redirect('/');
exit;
}wp-auth0 version
5.6.1
WordPress version
7.1
PHP version
8.4
Activity
kishore7snehil commentedon Sep 22, 2026
👋 @hanifn, thanks for raising this.
A fix is up in #967.
One deliberate difference from v4 is that the default handler shows a fixed message ("There was a problem with your log in.") rather than the raw
error_descriptionvalue. Botherroranderror_descriptionare attacker-controllable. Anyone can craft a URL like/wp-login.php?error=access_denied&error_description=<any text>and have that text appear on what looks like your login page without going through Auth0. Displaying the raw value verbatim would expose that as a content injection vector, so the default stays generic.If your site needs the specific Auth0 message shown to users, hook into
auth0_login_failed. It receives the sanitized$errorand$errorDescriptionvalues for you to render as needed.kishore7snehil commentedon Oct 8, 2026
This fix has been released as part of 6.0.0-beta.1 via #967. It is a prerelease, so please upgrade and let us know if the error page now shows up as expected.