CVE-2020-15222: Token reuse in Ory fosite
Summary
CVE-2020-15222: Token reuse in Ory fosite. Affects github.com/ory/fosite versions < 0.31.0. Fixed in 0.31.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ory fosite package is a Go library that provides OAuth2 and OpenID Connect server capabilities. It allows developers to implement authentication and authorization functionalities in their applications. This vulnerability affects versions prior to 0.31.0 of the package.
Vulnerability Detail
The vulnerability in Ory fosite arises when using the client authentication method 'private_key_jwt'. According to the OpenID specification, the 'jti' assertion in the token should be a unique identifier to prevent token reuse. However, Hydra, which is built on top of Ory fosite, does not enforce the uniqueness of this 'jti' value. As a result, an attacker can send the same token request multiple times, obtaining multiple access tokens. This can lead to unauthorized access and potential security breaches.
How To Fix
Latest published version: v0.49.0 as of 23 Oct 2026
go get github.com/ory/fosite@v0.49.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.31.0
This is the first release that contains the fix.
go get github.com/ory/fosite@v0.31.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround is to disallow clients from using the 'private_key_jwt' authentication method. This can be achieved by configuring the application to only allow other supported authentication methods.
Conclusion
The vulnerability in Ory fosite allows for token reuse when using the 'private_key_jwt' authentication method. This can lead to unauthorized access and potential security breaches. It is crucial to update the package to version 0.31.0 or later to fix the issue. If immediate update is not possible, disallowing the use of 'private_key_jwt' can serve as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/ory/fosite →
FAQ
Ory fosite is a Go library that provides OAuth2 and OpenID Connect server capabilities for implementing authentication and authorization in applications.
The vulnerability allows an attacker to reuse tokens obtained through the 'private_key_jwt' authentication method, potentially leading to unauthorized access and security breaches.
To fix this vulnerability, update the Ory fosite package to version 0.31.0 or later. Rebuild your application after updating the dependencies.
Yes, you can disallow clients from using the 'private_key_jwt' authentication method as a temporary workaround until the package is updated.
There is no known exploit available at the moment, but it is recommended to apply the fix as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/fosite.
