Insecure Session Management

2021-05-2505:21:21

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github.com/ory/fosite

insecure session management

vulnerability

token request

client authentication method

jti value

access tokens

EPSS

0.002

Percentile

61.6%

JSON

github.com/ory/fosite uses insecure session management. The vulnerability exists as it fails to validate the uniqueness of this jti value in private_key_jwt client authentication method, allowing an attacker to send the same token request twice with the same jti assertion to get two access tokens.