Improper Access Control

2023-01-1907:41:08

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

improper access control

github

token validation

arbitrary tokens

attacker

security vulnerability

EPSS

0.001

Percentile

31.6%

JSON

github.com/justinas/nosurf is vulnerable to Improper Access Control. The vulnerability exists in the verification of token functions in token.go due to improper input validation which allows an attacker to provide arbitrary tokens which are marked as valid.