CVE-2020-26160

Name of the Vulnerable Software and Affected Versions jwt-go versions prior to 4.0.0-preview1 jwt-go before 4.0.0-preview1

Description The issue allows attackers to bypass intended access restrictions in situations where the audience claim in a JWT token is an array of strings, rather than a single string. This occurs because the type assertion fails when m["aud"] is []string{}, resulting in an empty string as the value of aud. This poses a security problem if the JWT token is presented to a service lacking its own audience check.

Recommendations For jwt-go versions prior to 4.0.0-preview1, migrate to golang-jwt at version 3.2.1. As a temporary workaround, consider implementing an audience check in services that verify JWT tokens to prevent bypassing of intended access restrictions.