Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
form3tech-oss/jwt-go
master @ 32ab6a8
4
Fixes
1
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 4 prior fixes. Scrutinize any change in this area.
map_claims.go: most-fixed (2 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Attackers can bypass audience restrictions ('aud' claim checks) when the claim is supplied as a JSON array instead of a single string. This vulnerability is tracked under CVE-2020-26160.
Auth Bypass: Validation of numeric token claims like 'exp', 'iat', and 'nbf' can be bypassed if the values are supplied as non-numeric types, potentially leading to the acceptance of expired or premature tokens.
Auth Bypass: Improper wrapping of validation errors returned from the caller-provided keyFunc can mask specific validation failures, routing them into generic unverifiable errors and leading to incorrect evaluation states.