PT-2020-14290 · Ory · Ory Fosite

Name of the Vulnerable Software and Affected Versions: ORY Fosite versions prior to 0.34.0 Description: The issue arises from improper error handling in the TokenRevocationHandler, which ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful...

PT-2020-14289

Name of the Vulnerable Software and Affected Versions ORY Fosite versions prior to 0.31.0 Description The uniqueness of the jti value is not checked when using "private key jwt" authentication. According to the OpenId specification, the jti assertion must be unique to prevent token reuse. However...

CVE-2020-15222: Improper Authentication

In ORY Fosite the security first OAuth2 & OpenID Connect framework for Go before version 0.31.0, when using "privatekeyjwt" authentication the uniqueness of the jti value is not checked. When using client authentication method "privatekeyjwt", OpenId specification says the following about asserti...

CVE-2020-15223: Improper Handling of Exceptional Conditions

In ORY Fosite the security first OAuth2 & OpenID Connect framework for Go before version 0.34.0, the TokenRevocationHandler ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can...

Information Disclosure

github.com/ory/fosite is vulnerable to information disclosure. The vulnerability exists as the request body may contain client secrets to be exposed when POST-body based client authentication is enabled...

CVE-2006-5643: Undefined Security Weakness

Cross-site scripting XSS vulnerability in searchde.html in foresite CMS allows remote attackers to inject arbitrary web script or HTML via the query parameter...