CVE-2020-15084 json
Authorization bypass in express-jwt
published 2020-06-30 6 y ago modified 2026-07-08 4 mo ago also GHSA-6g6m-m6h5-w9gf , EUVD-2020-0463
- cvss
- 7.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 68%
- public exploits
- 0
- none known
Summary
In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the **secret**. You can fix this by specifying **algorithms** in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.
Patch / fix
Exploit prediction
1.22% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | express-jwt | <6.0.0 |
6.0.0 |
Affected products
- auth0 express-jwt
Classification
References
-
github.com
/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef
web, patch, third-party-advisory
-
github.com
/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-15084
advisory
Sources
- CVE List CVE-2020-15084
- GitHub Advisory GHSA-6g6m-m6h5-w9gf
- NVD CVE-2020-15084
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.