Skip to content
OpenAdvisories

Package · Go

github.com/ory/fosite

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.1
    CVE-2020-15222

    Replay of private_key_jwt possible in ORY Fosite

    In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked. When using client authentication method "private_key_jwt", OpenId …

    ory fosite github.com/ory/fosite Go
  • High 8.0
    CVE-2020-15223

    Ignored storage errors on token revokation in ORY Fosite

    In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the tok…

    ory fosite github.com/ory/fosite Go