Vulnerability

CVE-2020-26892

 Report advisory or correction

CVSS Score 9.8 critical

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-798

References

https://advisories.nats.io/CVE/CVE-2020-26892.txt
https://github.com/nats-io/jwt/security/advisories/GHSA-4w5x-x539-ppf5
https://github.com/nats-io/nats-server/security/advisories/GHSA-2c64-vj8g-vwrq
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-26892

[CVE-2020-26892] CWE-798: Use of Hard-coded Credentials

Description

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.

See github.com/nats-io/jwt package information