CVE-2020-26892: Incorrect handling of credential expiry in github.com/nats-io/jwt
Summary
CVE-2020-26892: Incorrect handling of credential expiry in github.com/nats-io/jwt. Affects github.com/nats-io/jwt versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Also tracked for
- github.com/nats-io/nats-server/v2 · Go
- golang-github-nats-io-jwt · Debian:12
The same CVE-2020-26892 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/nats-io/jwt package is a Go library that provides functionality for working with JSON Web Tokens (JWTs). JWTs are used for securely transmitting information between parties as a JSON object. The package includes features for creating, signing, and verifying JWTs. However, a vulnerability has been discovered in the package's handling of credential expiry.
Vulnerability Detail
The AccountClaims.IsRevoked and Export.IsRevoked functions in the github.com/nats-io/jwt package improperly validate expired credentials using the current system time instead of the issue time of the JWT. This means that expired credentials may still be considered valid, leading to potential security issues. The package versions prior to 1.1.0 are affected by this vulnerability. It is important to note that newer versions of the jwt package provide an IsClaimRevoked method that performs correct validation, rendering the IsRevoked method obsolete.
How To Fix
Latest published version: v1.2.2 as of 23 Oct 2026
go get github.com/nats-io/jwt@v1.2.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.0
This is the first release that contains the fix.
go get github.com/nats-io/jwt@v1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the package to the latest version.
Conclusion
In conclusion, the github.com/nats-io/jwt package has a vulnerability that allows expired credentials to be considered valid. To fix this vulnerability, it is important to update the package to version 1.1.0 or later. The Vulert Playground can be used to check if your application is affected by this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/nats-io/jwt →
FAQ
This vulnerability could allow expired credentials to be considered valid, potentially leading to unauthorized access or other security issues.
Versions prior to 1.1.0 are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file to the playground and it will alert you in real-time if any open-source vulnerabilities, including this one, are found.
Yes, updating the github.com/nats-io/jwt package to version 1.1.0 or later will fix this vulnerability.
There are several alternative JWT libraries available for Go, such as github.com/dgrijalva/jwt-go and github.com/golang-jwt/jwt. It is recommended to evaluate these libraries and choose one that best fits your project's requirements.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/nats-io/jwt.
