Search for vulnerabilities
Vulnerability details: VCID-gt63-t28m-aaak
Vulnerability ID VCID-gt63-t28m-aaak
Aliases CVE-2020-26160
GHSA-w73w-5m7g-f7qc
Summary jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-287 Improper Authentication
CWE-755 Improper Handling of Exceptional Conditions
CWE-284 Improper Access Control
System Score Found at
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-26160.html
rhas Moderate https://access.redhat.com/errata/RHSA-2020:5633
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0516
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0799
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2041
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2042
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2438
rhas Moderate https://access.redhat.com/errata/RHSA-2021:5110
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-26160.json
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00055 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00059 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00059 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00059 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00059 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00125 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00193 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00193 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00193 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00193 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00193 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00193 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00193 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00193 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00193 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00193 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00193 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00193 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
epss 0.00304 https://api.first.org/data/v1/epss?cve=CVE-2020-26160
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1883371
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26160
cvssv3.1 7.5 https://github.com/dgrijalva/jwt-go
generic_textual HIGH https://github.com/dgrijalva/jwt-go
cvssv3.1 7.5 https://github.com/dgrijalva/jwt-go/commit/ec0a89a131e3e8567adcb21254a5cd20a70ea4ab
generic_textual HIGH https://github.com/dgrijalva/jwt-go/commit/ec0a89a131e3e8567adcb21254a5cd20a70ea4ab
cvssv3.1 7.5 https://github.com/dgrijalva/jwt-go/issues/422
generic_textual HIGH https://github.com/dgrijalva/jwt-go/issues/422
cvssv3.1 7.5 https://github.com/dgrijalva/jwt-go/issues/462
generic_textual HIGH https://github.com/dgrijalva/jwt-go/issues/462
cvssv3.1 7.5 https://github.com/dgrijalva/jwt-go/pull/426
generic_textual HIGH https://github.com/dgrijalva/jwt-go/pull/426
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2020-26160
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2020-26160
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2020-26160
cvssv3.1 7.5 https://pkg.go.dev/vuln/GO-2020-0017
generic_textual HIGH https://pkg.go.dev/vuln/GO-2020-0017
cvssv3.1 7.5 https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
generic_textual HIGH https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-26160.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-26160.json
https://api.first.org/data/v1/epss?cve=CVE-2020-26160
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26160
https://github.com/dgrijalva/jwt-go
https://github.com/dgrijalva/jwt-go/commit/ec0a89a131e3e8567adcb21254a5cd20a70ea4ab
https://github.com/dgrijalva/jwt-go/issues/422
https://github.com/dgrijalva/jwt-go/issues/462
https://github.com/dgrijalva/jwt-go/pull/426
https://pkg.go.dev/vuln/GO-2020-0017
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
1883371 https://bugzilla.redhat.com/show_bug.cgi?id=1883371
971556 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971556
cpe:2.3:a:jwt-go_project:jwt-go:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:jwt-go_project:jwt-go:*:*:*:*:*:*:*:*
CVE-2020-26160 https://nvd.nist.gov/vuln/detail/CVE-2020-26160
RHSA-2020:5633 https://access.redhat.com/errata/RHSA-2020:5633
RHSA-2021:0516 https://access.redhat.com/errata/RHSA-2021:0516
RHSA-2021:0799 https://access.redhat.com/errata/RHSA-2021:0799
RHSA-2021:2041 https://access.redhat.com/errata/RHSA-2021:2041
RHSA-2021:2042 https://access.redhat.com/errata/RHSA-2021:2042
RHSA-2021:2438 https://access.redhat.com/errata/RHSA-2021:2438
RHSA-2021:5110 https://access.redhat.com/errata/RHSA-2021:5110
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-26160.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/dgrijalva/jwt-go
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/dgrijalva/jwt-go/commit/ec0a89a131e3e8567adcb21254a5cd20a70ea4ab
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/dgrijalva/jwt-go/issues/422
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/dgrijalva/jwt-go/issues/462
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/dgrijalva/jwt-go/pull/426
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-26160
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-26160
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-26160
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://pkg.go.dev/vuln/GO-2020-0017
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.13654
EPSS Score 0.00045
Published At April 18, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.