CVE-2020-15223: Improper handling of token revocation in github.com/ory/fosite
Summary
CVE-2020-15223: Improper handling of token revocation in github.com/ory/fosite. Affects github.com/ory/fosite versions < 0.34.0. Fixed in 0.34.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/ory/fosite is a Go library that provides a secure and flexible token management system for OAuth2 and OpenID Connect. It is widely used in various applications for handling authentication and authorization. However, a vulnerability has been discovered in the package that affects the token revocation process.
Vulnerability Detail
The vulnerability in github.com/ory/fosite arises from improper error handling in the token storage mechanism. When an error occurs in the underlying storage, the system may incorrectly report that a token has been successfully revoked when it is still valid. This can lead to unauthorized access and potential security breaches. Exploiting this vulnerability requires the ability to trigger errors in the token storage.
How To Fix
Latest published version: v0.49.0 as of 23 Oct 2026
go get github.com/ory/fosite@v0.49.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.34.0
This is the first release that contains the fix.
go get github.com/ory/fosite@v0.34.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to the fixed version as soon as possible.
Conclusion
In conclusion, the vulnerability in github.com/ory/fosite can lead to improper token revocation, potentially allowing unauthorized access to protected resources. It is crucial to update the package to version 0.34.0 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ory/fosite →
FAQ
The vulnerability allows an attacker to bypass token revocation and potentially gain unauthorized access to protected resources.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
No, versions 0.34.0 and later of the package have been fixed and are not affected by this vulnerability. It is recommended to update to the latest version to ensure the security of your application.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to update the package to the fixed version to mitigate any potential risks.
You can find more information about this vulnerability in the Open Source Vulnerability database at https://pkg.go.dev/vuln/GO-2021-0109.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/fosite.
