CVE-2021-23365

MEDIUM

tyk-identity-broker < 1.1.1 - Authentication Bypass via Go XML Parser

Title source: llm
STIX 2.1

Description

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).

References (5)

Core 5

Scores

CVSS v3 4.8
EPSS 0.0101
EPSS Percentile 58.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Details

CWE
CWE-287
Status published
Products (2)
tyk/tyk-identity-broker < 1.1.1
tyktechnologies/tyk-identity-broker 0 - 1.1.1Go
Published Apr 26, 2021
Tracked Since Feb 18, 2026