Read the docs
TI-2020-11995 Aliases CVE-2020-15223GHSA-7mqr-2v3q-v2wm

Ignored storage errors on token revokation in ORY Fosite

Priority LOW 38CWE-755Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store. This is fixed in version 0.34.0

Why it matters now

EPSS 0.01588 75th percentileScored 2026-11-07
Fix Fixed fosite (ory): 0.34.0github.com/ory/fosite (Go): 0.34.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
oryfositebefore 0.34.00.34.0Patch availableCNA
—github.com/ory/fosite (Go)before 0.34.00.34.0Patch availableGHSA-7mqr-2v3q-v2wm
  • fosite Vendorory Affected before 0.34.0 Fixed in 0.34.0 Patch available CNA
  • github.com/ory/fosite (Go) Vendor— Affected before 0.34.0 Fixed in 0.34.0 Patch available GHSA-7mqr-2v3q-v2wm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ory:fosite:*:*:*:*:*:*:*:*before 0.34.0Vulnerableory
  • cpe:2.3:a:ory:fosite:*:*:*:*:*:*:*:* Versions before 0.34.0 Vulnerable ·ory

Remediation

  • Fix · CNA fosite (ory) Fixed in 0.34.0
  • Fix · GHSA-7mqr-2v3q-v2wm github.com/ory/fosite (Go) Fixed in 0.34.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15223
  2. 2026-10-03 Alias added: GHSA-7mqr-2v3q-v2wm

References

Patch 1

Advisory 3

Other 1

  • TI-2020-11994 Replay of private_key_jwt possible in ORY Fosite CVSS 3.1HIGH 8.1
  • TI-2020-12006 Redirect URL matching ignores character casing CVSS 3.1MEDIUM 6.1
  • TI-2020-12005 OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences