GO-2020-0017 Authorization bypass in github.com/dgrijalva/jwt-go

If a JWT contains an audience claim with an array of strings, rather than a single string, and MapClaims.VerifyAudience is called with req set to false, then audience verification will be bypassed, allowing an invalid set of audiences to be provided...