CVE-2020-15240: Improper Verification of Cryptographic Signature

October 21, 2020 (updated November 18, 2021)

omniauth-auth0 improperly validates the JWT token signature when using the jwt_validator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. Impact is limited to the cases where you are using omniauth-auth0 and using the JWTValidator.verify method directly, or you are not authenticating using the SDK’s default Authorization Code Flow.

References

nvd.nist.gov/vuln/detail/CVE-2020-15240
rubygems.org/gems/omniauth-auth0

Code Behaviors & Features

Detect and mitigate CVE-2020-15240 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →