Description
Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It is patched in versions 1.0.4, 1.1.3 and 1.2.5.
References (2)
Core 2
Core References
Exploit, Mitigation, Third Party Advisory x_refsource_confirm
https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5
Patch, Third Party Advisory x_refsource_misc
https://github.com/faye/faye/commit/65d297d341b607f3cb0b5fa6021a625a991cc30e
Scores
CVSS v3
8.5
EPSS
0.0037
EPSS Percentile
58.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Details
CWE
CWE-287
Status
published
Products (2)
faye_project/faye
0.5.0 - 1.0.4 (2 CPE variants)
rubygems/faye
0.5.0 - 1.0.4RubyGems
Published
Apr 29, 2020
Tracked Since
Feb 18, 2026