CVE-2020-5300

MEDIUM EPSS 59.3%
Published Apr 6, 20206y ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Apr 6, 2020 6y ago
Last Modified Jun 17, 2026 2w ago

Description

In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not check the uniqueness of this `jti` value. Exploiting this vulnerability is somewhat difficult because: - TLS protects against MITM which makes it difficult to intercept valid tokens for replay attacks - The expiry time of the JWT gives only a short window of opportunity where it could be replayed This has been patched in version v1.4.0+oryOS.17

CVSS Details

Base Score
5.3
Exploitability
1.6
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
59.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-294

Affected Products 1

VendorProductVersionRange
oryhydra* <1.4.0

References 3

  • github.com https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3
    PatchThird Party Advisory
  • github.com https://github.com/ory/hydra/releases/tag/v1.4.0
    Third Party Advisory
  • github.com https://github.com/ory/hydra/security/advisories/GHSA-3p3g-vpw6-4w66
    Third Party Advisory

Remediation

  • github.com https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3
    PatchThird Party Advisory