CVE-2020-15222: Token reuse in github.com/ory/fosite
Summary
CVE-2020-15222: Token reuse in github.com/ory/fosite. Affects github.com/ory/fosite versions < 0.31.0. Fixed in 0.31.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package github.com/ory/fosite is a Go package that provides a secure and flexible OAuth2 and OpenID Connect server library. It is commonly used in Go applications to implement authentication and authorization functionality. The package includes features such as client authentication, access token generation, and token revocation.
Vulnerability Detail
The vulnerability identified as CVE-2020-15222 in github.com/ory/fosite involves the reuse of tokens. Specifically, the uniqueness of JWT IDs (jti) is not properly checked, allowing for the replay of JWTs. This means that an attacker could intercept a valid JWT and replay it, gaining unauthorized access to protected resources. The impact of this vulnerability can be severe, as it compromises the integrity of the authentication and authorization mechanisms provided by the package.
How To Fix
Latest published version: v0.49.0 as of 23 Oct 2026
go get github.com/ory/fosite@v0.49.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.31.0
This is the first release that contains the fix.
go get github.com/ory/fosite@v0.31.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to the fixed version as soon as possible.
Conclusion
The vulnerability identified as CVE-2020-15222 in github.com/ory/fosite allows for the reuse of tokens, compromising the security of authentication and authorization mechanisms. It is crucial to update the package to version 0.31.0 or later to fix this vulnerability. No known workarounds exist, and developers should ensure that all dependencies are also updated. For additional support, contact DevNack.com.
See every vulnerability recorded for github.com/ory/fosite →
FAQ
The vulnerability allows for the replay of JWTs, potentially granting unauthorized access to protected resources.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the time of writing. However, it is crucial to update the package to the fixed version to mitigate the risk.
While it is possible to manually validate the uniqueness of JWT IDs, it is recommended to update the package to the fixed version, as it includes proper checks and prevents token reuse.
For further support on vulnerability remediation or any other security concerns, you can reach out to info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/fosite.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
