Read the docs
TI-2020-11994 Aliases CVE-2020-15222GHSA-v3q9-2p3m-7g43

Replay of private_key_jwt possible in ORY Fosite

Priority LOW 37CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked. When using client authentication method "private_key_jwt", OpenId specification says the following about assertion `jti`: "A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties". Hydra does not seem to check the uniqueness of this `jti` value. This problem is fixed in version 0.31.0.

Why it matters now

EPSS 0.00867 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed fosite (ory): 0.31.0github.com/ory/fosite (Go): 0.31.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
oryfositebefore 0.31.00.31.0Patch availableCNA
—github.com/ory/fosite (Go)before 0.31.00.31.0Patch availableGHSA-v3q9-2p3m-7g43
  • fosite Vendorory Affected before 0.31.0 Fixed in 0.31.0 Patch available CNA
  • github.com/ory/fosite (Go) Vendor— Affected before 0.31.0 Fixed in 0.31.0 Patch available GHSA-v3q9-2p3m-7g43

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ory:fosite:*:*:*:*:*:*:*:*before 0.31.0Vulnerableory
  • cpe:2.3:a:ory:fosite:*:*:*:*:*:*:*:* Versions before 0.31.0 Vulnerable ·ory

Remediation

  • Fix · CNA fosite (ory) Fixed in 0.31.0
  • Fix · GHSA-v3q9-2p3m-7g43 github.com/ory/fosite (Go) Fixed in 0.31.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15222
  2. 2026-10-03 Alias added: GHSA-v3q9-2p3m-7g43

References

Exploit 1

Patch 1

Advisory 2

Other 3

  • TI-2020-11995 Ignored storage errors on token revokation in ORY Fosite CVSS 3.1HIGH 8.0
  • TI-2020-12006 Redirect URL matching ignores character casing CVSS 3.1MEDIUM 6.1
  • TI-2020-12005 OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences