CVE-2020-15222 json
Replay of private_key_jwt possible in ORY Fosite
published 2020-09-24 6 y ago modified 2026-07-08 4 mo ago also GHSA-v3q9-2p3m-7g43 , GO-2021-0110 , EUVD-2021-1195
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked. When using client authentication method "private_key_jwt", OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not seem to check the uniqueness of this `jti` value. This problem is fixed in version 0.31.0.
Patch / fix
- go github.com/ory/fosite 0.31.0
- ory fosite 0.31.0
Exploit prediction
0.87% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/ory/fosite/security/advisories/GHSA-v3q9-2p3m-7g43 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/ory/fosite | <0.31.0 |
0.31.0 |
Affected products
- ory fosite
Classification
References
-
github.com
/ory/fosite/commit/0c9e0f6d654913ad57c507dd9a36631e1858a3e9
web, patch, third-party-advisory
-
github.com
/ory/fosite/security/advisories/GHSA-v3q9-2p3m-7g43
web, exploit, third-party-advisory
-
openid.net
/specs/openid-connect-core-1_0.html#ClientAuthentication
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-15222
advisory
-
github.com
/ory/fosite
package
-
github.com
/ory/fosite/releases/tag/v0.31.0
web
-
pkg.go.dev
/vuln/GO-2021-0110
web
Sources
- CVE List CVE-2020-15222
- GitHub Advisory GHSA-v3q9-2p3m-7g43
- NVD CVE-2020-15222
- OSV GO-2021-0110
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.