Unscored CVE-2021-27306 EUVD-2021-14067GHSA-vh85-5xw7-5gvq

An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenti…

Published Mar 18, 2021 · Updated Aug 3, 2024 · Assigned by mitre

Description

An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes without a valid token JWT.

References

https://docs.konghq.com/enterprise/changelog/#core-1
https://medium.com/%40sew.campos/cve-2021-27306-access-an-authenticated-route-on-kong-api-gateway-6ae3d81968a3