CVE-2020-15222

Name of the Vulnerable Software and Affected Versions ORY Fosite versions prior to 0.31.0

Description The uniqueness of the jti value is not checked when using "private key jwt" authentication. According to the OpenId specification, the jti assertion must be unique to prevent token reuse. However, Hydra does not seem to check the uniqueness of this jti value, allowing the token to be replayed.

Recommendations For versions prior to 0.31.0, update to version 0.31.0 to fix the issue. As a temporary workaround, consider disabling the use of "private key jwt" authentication method until a patch is available. Restrict access to clients using "private key jwt" to minimize the risk of exploitation.