CVE-2020-28042

MEDIUM

ServiceStack < 5.9.2 - JWT Signature Verification Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-28042. PoCs published by z-bool.

AI-analyzed exploit summary This repository contains a Go-based tool for testing and exploiting various JWT vulnerabilities, including CVE-2020-28042 (empty signature attack). It supports multiple attack modes such as modifying the algorithm to 'none', signature validation bypass, and key injection.

Description

ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.

Exploits (1)

nomisec WORKING POC 282 stars
by z-bool · poc
https://github.com/z-bool/Venom-JWT

This repository contains a Go-based tool for testing and exploiting various JWT vulnerabilities, including CVE-2020-28042 (empty signature attack). It supports multiple attack modes such as modifying the algorithm to 'none', signature validation bypass, and key injection.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Applications using JWT for authentication
No auth needed
Prerequisites: Valid JWT token from the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Scores

CVSS v3 5.3
EPSS 0.3599
EPSS Percentile 97.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-347
Status published
Products (2)
nuget/ServiceStack 0 - 5.9.2NuGet
servicestack/servicestack < 5.9.2
Published Nov 02, 2020
Tracked Since Feb 18, 2026