CVE-2020-15223: Improper Handling of Exceptional Conditions in Ory Fosite
Summary
CVE-2020-15223: Ory fosite contains Improper Handling of Exceptional Conditions. Affects github.com/ory/fosite versions < 0.34.0. Fixed in 0.34.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ory Fosite is a Go package that provides a security framework for building OAuth2 and OpenID Connect servers. It offers various features and functionalities to handle authentication and authorization processes. The package is widely used in Go applications to implement secure authentication mechanisms.
Vulnerability Detail
The TokenRevocationHandler in Ory Fosite has a vulnerability that leads to improper handling of exceptional conditions. Specifically, the handler ignores errors coming from the storage, which can result in unexpected 200 status codes indicating successful token revocation while the token is still valid. This vulnerability can be exploited by an attacker if they can trigger errors in the storage. According to RFC 7009, a 503 HTTP code should be returned when the server encounters a problem, but this is not properly implemented in Ory Fosite.
How To Fix
Latest published version: v0.49.0 as of 23 Oct 2026
go get github.com/ory/fosite@v0.49.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.34.0
This is the first release that contains the fix.
go get github.com/ory/fosite@v0.34.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to update to the latest version of Ory Fosite to mitigate the issue.
Conclusion
The vulnerability in Ory Fosite's TokenRevocationHandler can result in improper handling of exceptional conditions, leading to unexpected successful token revocation. It is crucial to update to the latest version of Ory Fosite (0.34.0 or higher) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ory/fosite →
FAQ
Ory Fosite is a Go package used for building OAuth2 and OpenID Connect servers. It provides a security framework for handling authentication and authorization processes.
The vulnerability in Ory Fosite can lead to unexpected 200 status codes indicating successful token revocation while the token is still valid. This can be exploited by an attacker depending on their ability to trigger errors in the storage.
To fix this vulnerability, update your Ory Fosite package to version 0.34.0 or higher.
No specific workaround is provided for this vulnerability. Updating to the latest version is the recommended solution.
You can find more information about this vulnerability in the CVE-2020-15223 advisory and the Ory Fosite documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/fosite.
