reports/GO-2020-0017.yaml

module: github.com/dgrijalva/jwt-go
additional_packages:
  - module: github.com/dgrijalva/jwt-go/v4
    symbols:
      - MapClaims.VerifyAudience
    versions:
      - fixed: v4.0.0-preview1
versions:
  - introduced: v0.0.0-20150717181359-44718f8a89b0
description: |
  If a JWT contains an audience claim with an array of strings, rather
  than a single string, and `MapClaims.VerifyAudience` is called with
  `req` set to `false`, then audience verification will be bypassed,
  allowing an invalid set of audiences to be provided.
published: 2021-04-14T12:00:00Z
cve: CVE-2020-26160
credit: "@christopher-wong"
symbols:
  - MapClaims.VerifyAudience
links:
  commit: https://github.com/dgrijalva/jwt-go/commit/ec0a89a131e3e8567adcb21254a5cd20a70ea4ab
  context:
    - https://github.com/dgrijalva/jwt-go/issues/422