CVE-2020-15222CWE-287

Replay of private_key_jwt possible in ORY Fosite

High · published September 24, 2020

CVSS v3.1
8.1
EPSS
1%
Percentile
58.3
In the wild
Unconfirmed
What it is

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked. When using client authentication method "private_key_jwt", OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not seem to check the uniqueness of this `jti` value. This problem is fixed in version 0.31.0.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00867 · 58.3th percentile
Weakness
CWE-287 · Improper Authentication
Published
2020-09-24T16:15Z
EPSS history
Timeline
  • 24 SEP 16:15Z
    Replay of private_key_jwt possible in ORY Fosite
    cvelistv5