CVE-2020-26160 Authorization bypass in github.com/dgrijalva/jwt-go
Attackers can bypass access restrictions in jwt-go by exploiting audience claim type assertion failures, allowing unauthorized access to services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-26160?
CVE-2020-26160 is a high-severity authentication bypass vulnerability in n/a, published on 30 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.
Which versions are affected by CVE-2020-26160?
6 open source packages ship an affected version, including github.com/dgrijalva/jwt-go and github.com/dgrijalva/jwt-go/v4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dgrijalva/jwt-go Go | From 0.0.0-20150717181359-44718f8a89b0 | None |
github.com/dgrijalva/jwt-go Go | From 0.0.0-20150717181359-44718f8a89b0 to 3.2.0 | None |
github.com/dgrijalva/jwt-go Go | From 0.0.0-20150717181359-44718f8a89b0 to 3.2.0 | None |
github.com/dgrijalva/jwt-go/v4 Go | All versions | 4.0.0-preview1 |
github.com/dgrijalva/jwt-go/v4 Go | All versions | 4.0.0-preview1 |
github.com/dgrijalva/jwt-go/v4 Go | All versions | 4.0.0-preview1 |
Linux distribution packages (2)
telegraf openSUSE:Tumbleweed | All versions | 1.19.0-1.2 |
velero-plugin-for-microsoft-azure openSUSE:Tumbleweed | All versions | 1.3.1-1.1 |
Products include Jwt-Go Project Jwt-Go.
How do I fix CVE-2020-26160?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-26160 being exploited?
There is no known exploitation of CVE-2020-26160 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as AZL-41684, CLEANSTART-2025-CI95096, DEBIAN-CVE-2020-26160, GHSA-w73w-5m7g-f7qc, GO-2020-0017, SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515 and 3 more.