CVE-2020-26160

HIGH

jwt-go < 4.0.0-preview1 - Improper Audience Claim Validation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-26160. PoCs published by mlbrilliance.

AI-analyzed exploit summary This repository is a demo target for AURORA, containing intentionally vulnerable lockfiles to showcase supply chain vulnerability detection and remediation. It includes CVE-2020-26160 in a go.sum file, demonstrating a missing audience check in jwt-go v3.2.0.

Description

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

Exploits (1)

nomisec WRITEUP
by mlbrilliance · poc
https://github.com/mlbrilliance/aurora-demo-lockfile

This repository is a demo target for AURORA, containing intentionally vulnerable lockfiles to showcase supply chain vulnerability detection and remediation. It includes CVE-2020-26160 in a go.sum file, demonstrating a missing audience check in jwt-go v3.2.0.

Classification
Writeup 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: github.com/dgrijalva/jwt-go v3.2.0+incompatible
No auth needed
Prerequisites: Access to the repository · AURORA's Maestro process to detect and remediate
devstral-2 · analyzed May 19, 2026 Full analysis →

References (2)

Core 2
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/dgrijalva/jwt-go/pull/426

Scores

CVSS v3 7.5
EPSS 0.0007
EPSS Percentile 22.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-755 CWE-287
Status published
Products (3)
dgrijalva/jwt-go 0 - 4.0.0-preview1Go
dgrijalva/jwt-go 0.0.0-20150717181359-44718f8a89b0Go
jwt-go_project/jwt-go < 3.2.0
Published Sep 30, 2020
Tracked Since Feb 18, 2026