CVE-2020-15222

In ORY Fosite the security first OAuth2 & OpenID Connect framework for Go before version 0.31.0, when using "privatekeyjwt" authentication the uniqueness of the jti value is not checked. When using client authentication method "privatekeyjwt", OpenId specification says the following about asserti...

CVE-2020-15222

In ORY Fosite the security first OAuth2 & OpenID Connect framework for Go before version 0.31.0, when using "privatekeyjwt" authentication the uniqueness of the jti value is not checked. When using client authentication method "privatekeyjwt", OpenId specification says the following about asserti...

CVE-2020-15222

ORY Fosite (Go) prior to v0.31.0 did not check jti uniqueness when using private_key_jwt client authentication, enabling possible replay of token requests. OpenID Connect requires a unique jti to prevent reuse; this vulnerability is addressed in v0.31.0. Other connected records (RH, OSV, GHSA, CV...