PT-2020-14172 · Auth0 · Express-Jwt+1

Gkwang · Published 2020-06-30 · Updated 2025-12-17 · CVE-2020-15084

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions express-jwt versions 5.3.3 and earlier

Description The issue arises when the algorithms entry is not specified in the configuration, potentially leading to authorization bypass when used with libraries like jwks-rsa as the secret. This occurs because the algorithms entry is not being enforced in versions up to and including 5.3.3. To be affected, one must be using express-jwt, not have algorithms configured, and use libraries such as jwks-rsa as the secret.

Recommendations For express-jwt versions 5.3.3 and earlier, specify algorithms in the express-jwt configuration to fix the issue. For example, configure algorithms as ['RS256'] to restrict allowed algorithms. This change will not impact users if algorithms was already specified, as the patch makes algorithms a required configuration.

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2020-15084

GHSA-6G6M-M6H5-W9GF

Affected Products

Express-Jwt

Jwks-Rsa

References · 7

• https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15084 · Security Note
• https://osv.dev/vulnerability/GHSA-6g6m-m6h5-w9gf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15084 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2020-15084 · Vendor Advisory
• https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf · Note
• https://t.me/cvenotify/4747 · Telegram Post