Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-47qq-pxyn-wqge
Vulnerability ID VCID-47qq-pxyn-wqge
Aliases CVE-2020-26160
GHSA-w73w-5m7g-f7qc
Summary Authorization bypass in github.com/dgrijalva/jwt-go jwt-go allows attackers to bypass intended access restrictions in situations with `[]string{}` for `m["aud"]` (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to [golang-jwt](https://github.com/golang-jwt/jwt) at version 3.2.1
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-287 Improper Authentication
CWE-755 Improper Handling of Exceptional Conditions
CWE-284 Improper Access Control
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-26160.json
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
cvssv3.1 7.5 https://github.com/dgrijalva/jwt-go
generic_textual HIGH https://github.com/dgrijalva/jwt-go
cvssv3.1 7.5 https://github.com/dgrijalva/jwt-go/commit/ec0a89a131e3e8567adcb21254a5cd20a70ea4ab
generic_textual HIGH https://github.com/dgrijalva/jwt-go/commit/ec0a89a131e3e8567adcb21254a5cd20a70ea4ab
cvssv3.1 7.5 https://github.com/dgrijalva/jwt-go/issues/422
generic_textual HIGH https://github.com/dgrijalva/jwt-go/issues/422
cvssv3.1 7.5 https://github.com/dgrijalva/jwt-go/issues/462
generic_textual HIGH https://github.com/dgrijalva/jwt-go/issues/462
cvssv3.1 7.5 https://github.com/dgrijalva/jwt-go/pull/426
generic_textual HIGH https://github.com/dgrijalva/jwt-go/pull/426
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2020-26160
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2020-26160
cvssv3.1 7.5 https://pkg.go.dev/vuln/GO-2020-0017
generic_textual HIGH https://pkg.go.dev/vuln/GO-2020-0017
cvssv3.1 7.5 https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
generic_textual HIGH https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-26160.json
https://api.first.org/data/v1/epss?cve=CVE-2020-26160
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26160
https://github.com/dgrijalva/jwt-go
https://github.com/dgrijalva/jwt-go/commit/ec0a89a131e3e8567adcb21254a5cd20a70ea4ab
https://github.com/dgrijalva/jwt-go/issues/422
https://github.com/dgrijalva/jwt-go/issues/462
https://github.com/dgrijalva/jwt-go/pull/426
https://nvd.nist.gov/vuln/detail/CVE-2020-26160
https://pkg.go.dev/vuln/GO-2020-0017
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
1883371 https://bugzilla.redhat.com/show_bug.cgi?id=1883371
971556 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971556
RHSA-2020:5633 https://access.redhat.com/errata/RHSA-2020:5633
RHSA-2021:0516 https://access.redhat.com/errata/RHSA-2021:0516
RHSA-2021:2041 https://access.redhat.com/errata/RHSA-2021:2041
RHSA-2021:2042 https://access.redhat.com/errata/RHSA-2021:2042
RHSA-2021:2438 https://access.redhat.com/errata/RHSA-2021:2438
RHSA-2021:5110 https://access.redhat.com/errata/RHSA-2021:5110
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-26160.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/dgrijalva/jwt-go
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/dgrijalva/jwt-go/commit/ec0a89a131e3e8567adcb21254a5cd20a70ea4ab
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/dgrijalva/jwt-go/issues/422
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/dgrijalva/jwt-go/issues/462
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/dgrijalva/jwt-go/pull/426
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-26160
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://pkg.go.dev/vuln/GO-2020-0017
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.17148
EPSS Score 0.00055
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:02:56.847348+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-w73w-5m7g-f7qc/GHSA-w73w-5m7g-f7qc.json 38.0.0