CVE-2020-15222

Katalog CVE

CVSS 8.1 · High EPSS 0,87%

Kerentanan Improper Authentication pada ory fosite. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked. When using client authentication method "private_key_jwt", OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not seem to check the uniqueness of this `jti` value. This problem is fixed in version 0.31.0.

Rincian

Terbit di NVD

24 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,87% peluang dieksploitasi; lebih tinggi dari 57,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ory/fosite/commit/0c9e0f6d654913ad57c507dd9a36631e1858a3e9 patch · advisory pihak ketiga
• https://github.com/ory/fosite/security/advisories/GHSA-v3q9-2p3m-7g43 exploit · advisory pihak ketiga
• https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication advisory pihak ketiga