Authorization bypass in github.com/dgrijalva/jwt-go
Overview
Source
ID
GO-2020-0017
Aliases
CVE-2020-26160
GHSA-w73w-5m7g-f7qc
Affected package
Description
If a JWT contains an audience claim with an array of strings, rather than a single string, and MapClaims.VerifyAudience is called with req set to false, then audience verification will be bypassed, allowing an invalid set of audiences to be provided.
Summary
35.90k
Total packages affected
help_outline
Packages with at least one version that is affected by the advisory or has an affected dependency.
2.85k
Packages with a known fix
help_outline
Packages with versions affected by the advisory that have a greater version that is not affected.
2.67%
Total ecosystem affected
help_outline
The proportion of packages in the ecosystem that are affected by the advisory (fixed or not).
Affected Version: Introduced: 0.0.0-20150717181359-44718f8a89b0
Affected
Affected Version: Introduced: 0, Fixed: 4.0.0-preview1