Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-c1yy-z5wd-wfes
Vulnerability ID VCID-c1yy-z5wd-wfes
Aliases CVE-2020-11020
GHSA-qpg4-4w7w-2mq5
Summary Authentication and extension bypass in Faye
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-287 Improper Authentication
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2020-11020
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2020-11020
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2020-11020
epss 0.00365 https://api.first.org/data/v1/epss?cve=CVE-2020-11020
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-qpg4-4w7w-2mq5
cvssv3.1 8.5 https://github.com/faye/faye
generic_textual HIGH https://github.com/faye/faye
cvssv3.1 8.5 https://github.com/faye/faye/commit/65d297d341b607f3cb0b5fa6021a625a991cc30e
generic_textual HIGH https://github.com/faye/faye/commit/65d297d341b607f3cb0b5fa6021a625a991cc30e
cvssv3 8.5 https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5
cvssv3.1 8.5 https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5
cvssv3.1_qr HIGH https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5
generic_textual HIGH https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5
cvssv3.1 8.5 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faye/CVE-2020-11020.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faye/CVE-2020-11020.yml
cvssv3.1 8.5 https://nvd.nist.gov/vuln/detail/CVE-2020-11020
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2020-11020
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2020-11020
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11020
https://github.com/faye/faye
https://github.com/faye/faye/commit/65d297d341b607f3cb0b5fa6021a625a991cc30e
959392 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959392
CVE-2020-11020 https://nvd.nist.gov/vuln/detail/CVE-2020-11020
CVE-2020-11020.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faye/CVE-2020-11020.yml
GHSA-qpg4-4w7w-2mq5 https://github.com/advisories/GHSA-qpg4-4w7w-2mq5
GHSA-qpg4-4w7w-2mq5 https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Found at https://github.com/faye/faye
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Found at https://github.com/faye/faye/commit/65d297d341b607f3cb0b5fa6021a625a991cc30e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Found at https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faye/CVE-2020-11020.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-11020
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.58895
EPSS Score 0.00365
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:26:02.462416+00:00 GHSA Importer Import https://github.com/advisories/GHSA-qpg4-4w7w-2mq5 38.6.0