Vulnerabilities affecting this package (1)
| Vulnerability |
Summary |
Fixed by |
VCID-gt63-t28m-aaak
Aliases:
CVE-2020-26160
GHSA-w73w-5m7g-f7qc
|
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.
|
There are no reported fixed by versions.
|
Vulnerabilities fixed by this package (0)
| Vulnerability |
Summary |
Aliases |
|
This package is not known to fix vulnerabilities.
|