{"id":"CVE-2020-26160","aliases":["GHSA-w73w-5m7g-f7qc","GO-2020-0017","SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515"],"title":"Authorization bypass in github.com/dgrijalva/jwt-go","summary":"Authorization bypass in github.com/dgrijalva/jwt-go","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendor":"dgrijalva","product":"github.com/dgrijalva/jwt-go","ecosystem":"go","affected":["github.com/dgrijalva/jwt-go >= 0.0.0-20150717181359-44718f8a89b0, <= 3.2.0","github.com/dgrijalva/jwt-go/v4 < 4.0.0-preview1"],"patched":["github.com/dgrijalva/jwt-go/v4 4.0.0-preview1"],"published":"2021-05-18","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-w73w-5m7g-f7qc","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26160"},{"url":"https://github.com/dgrijalva/jwt-go/issues/422"},{"url":"https://github.com/dgrijalva/jwt-go/issues/462"},{"url":"https://github.com/dgrijalva/jwt-go/pull/426"},{"url":"https://github.com/dgrijalva/jwt-go/commit/ec0a89a131e3e8567adcb21254a5cd20a70ea4ab"},{"url":"https://github.com/dgrijalva/jwt-go"},{"url":"https://pkg.go.dev/vuln/GO-2020-0017"},{"url":"https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515"}],"tags":["osv","go","exploit-available"],"epss":0.02158,"epssPercentile":0.81424,"ingestedAt":"2026-07-09T18:56:36.957Z","exploits":{"github":1,"githubRepos":["https://github.com/mlbrilliance/aurora-demo-lockfile"],"checkedAt":"2026-09-26T09:05:26.132Z"},"exploitAvailable":true,"slug":"CVE-2020-26160","body":"## Overview\n\njwt-go allows attackers to bypass intended access restrictions in situations with `[]string{}` for `m[\"aud\"]` (which is allowed by the specification). Because the type assertion fails, \"\" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to [golang-jwt](https://github.com/golang-jwt/jwt) at version 3.2.1\n\n## Affected packages\n\n- `github.com/dgrijalva/jwt-go >= 0.0.0-20150717181359-44718f8a89b0, <= 3.2.0`\n- `github.com/dgrijalva/jwt-go/v4 < 4.0.0-preview1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/dgrijalva/jwt-go/v4 4.0.0-preview1`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[{"seq":4491,"id":"CVE-2020-26160","ts":1788887184206,"field":"exploit_available","old":"false","new":"true"},{"seq":3374,"id":"CVE-2020-26160","ts":1788886303001,"field":"exploit_available","old":"true","new":"false"},{"seq":2229,"id":"CVE-2020-26160","ts":1788882972635,"field":"exploit_available","old":"false","new":"true"},{"seq":1258,"id":"CVE-2020-26160","ts":1788882384252,"field":"exploit_available","old":"true","new":"false"},{"seq":372,"id":"CVE-2020-26160","ts":1788881819627,"field":"exploit_available","old":"false","new":"true"}]}