CVE-2020-15222: Replay Attack Vulnerability in github.com/ory/fosite
Summary
GO-2021-0092: Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Affects github.com/ory/fosite versions < 0.31.0. Fixed in 0.31.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/ory/fosite is a Go package that provides a secure and flexible OAuth2 and OpenID Connect server implementation. It is widely used for authentication and authorization purposes in various applications. However, a vulnerability has been discovered in the package that allows for replay attacks.
Vulnerability Detail
The vulnerability in github.com/ory/fosite stems from the lack of uniqueness checking for JWT IDs (jti). This means that an attacker can replay a JWT, leading to unauthorized access or other malicious activities. The impact of this vulnerability can be severe, as it compromises the integrity and security of the authentication and authorization process.
How To Fix
Latest published version: v0.49.0 as of 23 Oct 2026
go get github.com/ory/fosite@v0.49.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.31.0
This is the first release that contains the fix.
go get github.com/ory/fosite@v0.31.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to the fixed version as soon as possible.
Conclusion
The replay attack vulnerability in github.com/ory/fosite can have severe consequences for the security of authentication and authorization processes. It is crucial to update the package to version 0.31.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ory/fosite →
FAQ
The vulnerability allows for replay attacks, which can lead to unauthorized access or other malicious activities.
To fix this vulnerability, update the package to version 0.31.0 or later.
No, there is no known workaround. Updating the package is the only solution.
Yes, all versions prior to 0.31.0 are affected by this vulnerability.
You can find more information about this vulnerability in the official vulnerability report: https://pkg.go.dev/vuln/GO-2021-0092
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/fosite.
