CVE-2020-15222 - CVE House

Back to Database

Status published High CVE-2020-15222

Replay of private_key_jwt possible in ORY Fosite

8.1 CVSS

Vulnerability Description

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked. When using client authentication method "private_key_jwt", OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not seem to check the uniqueness of this `jti` value. This problem is fixed in version 0.31.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15222

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from ory

View All →

Ory Kratos's `highest_available` setting does not properly respect code + mfa credentials

Possible bypass of token claim validation when OAuth2 Introspection caching is enabled

Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra

Redirect URL matching ignores character casing

OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses

Affected Vendor

ory

View all reports →

Affected Software

fosite

Vulnerable Versions:

< 0.31.0

Timeline

Official Publish: September 24th, 2020

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1556 Modify Authentication Process

Credential Access