The vulnerability of the jwt-go library for working with JSON Web Tokens allows attackers to circumvent authentication procedures, thereby allowing them to elevate their privileges.

🗓️ 17 Sep 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Vulnerability in jwt-go library allows attackers to bypass authentication and escalate privileges in JSON tokens.

Reporter	Title	Published	Views	Family All 49
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Insights is affected by JWT-Go vulnerability (CVE-2020-26160)	2 Feb 202216:08	–	ibm
IBM Security Bulletins	Security Bulletin: A jwt-go vulnerability affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2020-26160)	12 Jan 202321:59	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability have been identified in jwt-go shipped with IBM Netcool Operations Insight Event Integrations Operator (CVE-2020-26160)	14 Dec 202002:44	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202318:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in go.etcd.io/etcd package affects IBM Watson Machine Learning Accelerator on Cloud Pak for Data	6 Dec 202316:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM CICS TX Advanced is vulnerable to multiple vulnerabilities in Kubernetes.	14 Feb 202321:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM CICS TX Standard is vulnerable to multiple vulnerabilities in Kubernetes.	14 Feb 202321:14	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202318:36	–	ibm
AlpineLinux	CVE-2020-26160	30 Sep 202012:57	–	alpinelinux
Tenable Nessus	Azure Linux 3.0 Security Update: dcos-cli (CVE-2020-26160)	22 Jan 202600:00	–	nessus

Vulners

Node

OR

json_object_signing_and_encryption jwt-goRange<3.2.0

red_hat,openshift_serverlessMatch1.13

Source	Link
github	www.github.com/dgrijalva/jwt-go/pull/426
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-26160
access	www.access.redhat.com/security/cve/cve-2020-26160
suse	www.suse.com/security/cve/CVE-2020-26160.html
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.7/
web	www.web.nvd.nist.gov/view/vuln/detail

24 Oct 2025 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 37.5

CVSS 27.8

EPSS0.02158

JSON Web Tokens authentication bypass elevated privileges library vulnerability