Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/golang-github-dgrijalva-jwt-go@3.0.0.1%2BREALLY.2.6.0-3
purl pkg:deb/debian/golang-github-dgrijalva-jwt-go@3.0.0.1%2BREALLY.2.6.0-3
Next non-vulnerable version 3.2.0-3
Latest non-vulnerable version 3.2.0-3
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-47qq-pxyn-wqge
Aliases:
CVE-2020-26160
GHSA-w73w-5m7g-f7qc
Authorization bypass in github.com/dgrijalva/jwt-go jwt-go allows attackers to bypass intended access restrictions in situations with `[]string{}` for `m["aud"]` (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to [golang-jwt](https://github.com/golang-jwt/jwt) at version 3.2.1
3.2.0-3
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-15T23:53:41.519191+00:00 Debian Oval Importer Affected by VCID-47qq-pxyn-wqge https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.4.0
2026-04-11T23:28:00.882310+00:00 Debian Oval Importer Affected by VCID-47qq-pxyn-wqge https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.3.0
2026-04-08T23:01:00.613954+00:00 Debian Oval Importer Affected by VCID-47qq-pxyn-wqge https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.1.0