Vulnetix
Try Vulnetix Request Demo
CVE-2020-26160 PUBLISHED

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

EPSS 0.05% · 17.1th percentile

Risk Scores

EPSS Score
0.05%
17.1th percentile

Affected Products

VendorProductVersions
Ubuntu:20.04:LTSgolang-github-dgrijalva-jwt-go0, 3.2.0-1, 3.0.0.1+REALLY.2.6.0-3
Ubuntu:25.10golang-github-coreos-discovery-etcd-io2.0.0+git2019.04.19.git.78fb45d3c9-4build1, 0
Ubuntu:20.04:LTSgolang-github-coreos-discovery-etcd-io0, 2.0.0+git2019.04.19.git.78fb45d3c9-1
Ubuntu:18.04:LTSgolang-github-dgrijalva-jwt-go0, 3.0.0.1+REALLY.2.6.0-3, 3.0.0.1+REALLY.2.6.0-1
Ubuntu:24.04:LTSgolang-github-coreos-discovery-etcd-io2.0.0+git2019.04.19.git.78fb45d3c9-4ubuntu0.24.04.2, 2.0.0+git2019.04.19.git.78fb45d3c9-4ubuntu0.24.04.3, 0
Ubuntu:22.04:LTSgolang-github-coreos-discovery-etcd-io0, 2.0.0+git2019.04.19.git.78fb45d3c9-4
Ubuntu:16.04:LTSgolang-github-dgrijalva-jwt-go0, 2.3.0-1

Timeline

References

Open in Interactive Console →