jwt-go: access restriction bypass vulnerability

🗓️ 19 May 2021 10:26:16Reported by RedHatType

redhat🔗 access.redhat.com👁 6 Views

jwt-go bypasses audience verification when m["aud"] is empty string slice and required is false.

Reporter	Title	Published	Views	Family All 57
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Insights is affected by JWT-Go vulnerability (CVE-2020-26160)	2 Feb 202216:08	–	ibm
IBM Security Bulletins	Security Bulletin: A jwt-go vulnerability affects IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data (CVE-2020-26160)	12 Jan 202321:59	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability have been identified in jwt-go shipped with IBM Netcool Operations Insight Event Integrations Operator (CVE-2020-26160)	14 Dec 202002:44	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202318:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in go.etcd.io/etcd package affects IBM Watson Machine Learning Accelerator on Cloud Pak for Data	6 Dec 202316:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM CICS TX Advanced is vulnerable to multiple vulnerabilities in Kubernetes.	14 Feb 202321:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM CICS TX Standard is vulnerable to multiple vulnerabilities in Kubernetes.	14 Feb 202321:14	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202318:36	–	ibm
AlpineLinux	CVE-2020-26160	30 Sep 202012:57	–	alpinelinux
Tenable Nessus	Azure Linux 3.0 Security Update: dcos-cli (CVE-2020-26160)	22 Jan 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	ppc64le	mcg	5.7.0-69.85e2026.5.7.el8	mcg-5.7.0-69.85e2026.5.7.el8.ppc64le.rpm
Red Hat Enterprise Linux	8	s390x	mcg	5.7.0-69.85e2026.5.7.el8	mcg-5.7.0-69.85e2026.5.7.el8.s390x.rpm
Red Hat Enterprise Linux	8	x86_64	mcg	5.7.0-69.85e2026.5.7.el8	mcg-5.7.0-69.85e2026.5.7.el8.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2020-26160
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-26160
snyk	www.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
cve	www.cve.org/CVERecord

21 Aug 2026 20:14Current

7.2High risk

Vulners AI Score7.2

CVSS 25

CVSS 3.17.5

EPSS0.02158

jwt-go audience bypass empty audience slice required false audience verification