CVE-2020-15240

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-15240
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15240.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-15240
Aliases
Published
2020-10-21T18:15:12.813Z
Modified
2026-07-09T06:34:42.489654Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the jwt_validator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all of the following conditions apply: 1. You are using omniauth-auth0. 2. You are using JWTValidator.verify method directly OR you are not authenticating using the SDK’s default Authorization Code Flow. The issue is patched in version 2.4.1.

References

Affected packages

Git / github.com/auth0/omniauth-auth0

Affected ranges

Type
GIT
Repo
https://github.com/auth0/omniauth-auth0
Events
Introduced
c091def58305469b55365a29c12431b8cd07cd4a
Fixed
ce6824dd0ca306b5d0e7bf33fdae8404b0259da6
Fixed
fd3a14f4ccdfbc515d1121d6378ff88bf55a7a7a
Database specific 
{
    "cpe": "cpe:2.3:a:auth0:omniauth-auth0:*:*:*:*:*:ruby:*:*",
    "extracted_events": [
        {
            "introduced": "2.3.0"
        },
        {
            "fixed": "2.4.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.3.0
v2.3.1
v2.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15240.json"