{"id":"CVE-2020-26160","title":"jwt-go: access restriction bypass vulnerability (CVE-2020-26160)","summary":"A vulnerability was found in jwt-go where it is vulnerable to Access Restriction Bypass if m[\"aud\"] happens to be []string{}, as allowed by the spec, the type assertion fails and the value of aud is \"\". This can cause audience verification…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":"CWE-284","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","affected":["openshift_service_mesh 1","openshift_container_platform 3.11","openshift_container_platform 4","openshift_virtualization 1","openshift_virtualization 2","quay 3","storage 3","cryostat_2_on_rhel 8","openshift_serverless 1.13","openshift_container_storage_4_7_on_rhel_8","openshift_container_platform 4.7","openshift_container_platform 4.8"],"patched":["cryostat_2_on_rhel 8","openshift_serverless 1.13","openshift_container_storage_4_7_on_rhel_8","openshift_container_platform 4.7","openshift_container_platform 4.8"],"published":"2020-09-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T17:14:19+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-26160.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-26160.json"},{"url":"https://access.redhat.com/security/cve/CVE-2020-26160"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883371"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-26160"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26160"},{"url":"https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515"},{"url":"https://access.redhat.com/errata/RHSA-2021:5110"},{"url":"https://access.redhat.com/errata/RHSA-2021:0516"},{"url":"https://access.redhat.com/errata/RHSA-2021:2042"},{"url":"https://access.redhat.com/errata/RHSA-2021:2041"},{"url":"https://access.redhat.com/errata/RHSA-2020:5633"},{"url":"https://access.redhat.com/errata/RHSA-2021:2438"},{"url":"https://github.com/dgrijalva/jwt-go/issues/422"},{"url":"https://github.com/dgrijalva/jwt-go/issues/462"},{"url":"https://github.com/dgrijalva/jwt-go/pull/426"},{"url":"https://github.com/dgrijalva/jwt-go/commit/ec0a89a131e3e8567adcb21254a5cd20a70ea4ab"},{"url":"https://github.com/dgrijalva/jwt-go"},{"url":"https://pkg.go.dev/vuln/GO-2020-0017"}],"tags":["csaf","vex","red-hat","exploit-available","osv","go"],"epss":0.02158,"epssPercentile":0.82097,"exploits":{"github":1,"githubRepos":["https://github.com/mlbrilliance/aurora-demo-lockfile"],"checkedAt":"2026-10-27T16:39:15.561Z"},"exploitAvailable":true,"aliases":["GHSA-w73w-5m7g-f7qc","GO-2020-0017","SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515"],"ecosystem":"go","ingestedAt":"2026-07-09T18:56:36.957Z","slug":"CVE-2020-26160","body":"## Overview\n\nA vulnerability was found in jwt-go where it is vulnerable to Access Restriction Bypass if m[\"aud\"] happens to be []string{}, as allowed by the spec, the type assertion fails and the value of aud is \"\". This can cause audience verification to succeed even if the audiences being passed are incorrect if required is set to false.\n\n## Vendor advisories\n\n- **RHSA-2021:5110** · Red Hat · fixed in: Cryostat 2 on RHEL 8 · released 2021-12-14 · [advisory](https://access.redhat.com/errata/RHSA-2021:5110)\n- **RHSA-2021:0516** · Red Hat · fixed in: Openshift Serverless 1.13 · released 2021-02-18 · [advisory](https://access.redhat.com/errata/RHSA-2021:0516)\n- **RHSA-2021:2042** · Red Hat · fixed in: Red Hat OpenShift Container Storage 4.7 on RHEL-8 · released 2021-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2021:2042)\n- **RHSA-2021:2041** · Red Hat · fixed in: Red Hat OpenShift Container Storage 4.7 on RHEL-8 · released 2021-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2021:2041)\n- **RHSA-2020:5633** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.7 · released 2021-02-24 · [advisory](https://access.redhat.com/errata/RHSA-2020:5633)\n- **RHSA-2021:2438** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.8 · released 2021-07-27 · [advisory](https://access.redhat.com/errata/RHSA-2021:2438)\n- **Red Hat VEX** · Moderate · affected: OpenShift Service Mesh 1, Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Virtualization 1, Red Hat OpenShift Virtualization 2, Red Hat Quay 3, … · no fix planned: Red Hat OpenShift Virtualization 1, OpenShift Service Mesh 1, Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-26160.json)\n\n**jwt-go: access restriction bypass vulnerability** — rated Moderate by Red Hat. Released 2020-09-15, updated 2026-10-16.\n\nAffected:\n\n- OpenShift Service Mesh 1\n- Red Hat OpenShift Container Platform 3.11\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Virtualization 1\n- Red Hat OpenShift Virtualization 2\n- Red Hat Quay 3\n- Red Hat Storage 3\n\nFixed:\n\n- Cryostat 2 on RHEL 8\n- Openshift Serverless 1.13\n- Red Hat OpenShift Container Storage 4.7 on RHEL-8\n- Red Hat OpenShift Container Platform 4.7\n- Red Hat OpenShift Container Platform 4.8\n\nNo fix planned:\n\n- Red Hat OpenShift Virtualization 1\n- OpenShift Service Mesh 1\n- Red Hat OpenShift Container Platform 3.11\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Virtualization 2\n- Red Hat Quay 3\n- Red Hat Storage 3\n\nNot affected:\n\n- Red Hat OpenShift Container Storage 4.7 on RHEL-8\n- Red Hat OpenShift Container Platform 4.7\n- Red Hat OpenShift Container Platform 4.8\n- Distributed Tracing Jaeger 1\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat OpenShift Container Platform 3.11\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Virtualization 1\n- Red Hat OpenShift Virtualization 2\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2021:5110\nSee the documentation at:\nhttps://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless_applications/index https://access.redhat.com/errata/RHSA-2021:0516\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2021:2042\n\n## Package advisory (CVE-2020-26160)\n\nAffected packages:\n\n- `github.com/dgrijalva/jwt-go >= 0.0.0-20150717181359-44718f8a89b0, <= 3.2.0`\n- `github.com/dgrijalva/jwt-go/v4 < 4.0.0-preview1`\n\nPatched in:\n\n- `github.com/dgrijalva/jwt-go/v4 4.0.0-preview1`\n\nSource: https://osv.dev/vulnerability/GHSA-w73w-5m7g-f7qc","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[{"seq":4491,"id":"CVE-2020-26160","ts":1788887184206,"field":"exploit_available","old":"false","new":"true"},{"seq":3374,"id":"CVE-2020-26160","ts":1788886303001,"field":"exploit_available","old":"true","new":"false"},{"seq":2229,"id":"CVE-2020-26160","ts":1788882972635,"field":"exploit_available","old":"false","new":"true"},{"seq":1258,"id":"CVE-2020-26160","ts":1788882384252,"field":"exploit_available","old":"true","new":"false"},{"seq":372,"id":"CVE-2020-26160","ts":1788881819627,"field":"exploit_available","old":"false","new":"true"}]}