---
id: CVE-2020-26160
aliases:
  - GHSA-w73w-5m7g-f7qc
  - GO-2020-0017
  - SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
title: Authorization bypass in github.com/dgrijalva/jwt-go
summary: Authorization bypass in github.com/dgrijalva/jwt-go
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: dgrijalva
product: github.com/dgrijalva/jwt-go
ecosystem: go
affected:
  - 'github.com/dgrijalva/jwt-go >= 0.0.0-20150717181359-44718f8a89b0, <= 3.2.0'
  - github.com/dgrijalva/jwt-go/v4 < 4.0.0-preview1
patched:
  - github.com/dgrijalva/jwt-go/v4 4.0.0-preview1
published: '2021-05-18'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-w73w-5m7g-f7qc'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-26160'
  - url: 'https://github.com/dgrijalva/jwt-go/issues/422'
  - url: 'https://github.com/dgrijalva/jwt-go/issues/462'
  - url: 'https://github.com/dgrijalva/jwt-go/pull/426'
  - url: >-
      https://github.com/dgrijalva/jwt-go/commit/ec0a89a131e3e8567adcb21254a5cd20a70ea4ab
  - url: 'https://github.com/dgrijalva/jwt-go'
  - url: 'https://pkg.go.dev/vuln/GO-2020-0017'
  - url: 'https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515'
tags:
  - osv
  - go
  - exploit-available
epss: 0.02158
epssPercentile: 0.81424
ingestedAt: '2026-07-09T18:56:36.957Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/mlbrilliance/aurora-demo-lockfile'
  checkedAt: '2026-09-26T09:05:26.132Z'
exploitAvailable: true
---

## Overview

jwt-go allows attackers to bypass intended access restrictions in situations with `[]string{}` for `m["aud"]` (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to [golang-jwt](https://github.com/golang-jwt/jwt) at version 3.2.1

## Affected packages

- `github.com/dgrijalva/jwt-go >= 0.0.0-20150717181359-44718f8a89b0, <= 3.2.0`
- `github.com/dgrijalva/jwt-go/v4 < 4.0.0-preview1`

## Remediation

Upgrade to a patched release:

- `github.com/dgrijalva/jwt-go/v4 4.0.0-preview1`