CVE-2020-15222: high-severity vulnerability in ory fosite
Replay of private_key_jwt possible in ORY Fosite
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
ORY Fosite fails to check if a JWT token ID (jti) has already been used during private key authentication, allowing attackers to replay the same token multiple times instead of using it just once. This breaks a key security requirement that prevents reusing authentication tokens.
The vulnerability exists in the private_key_jwt client authentication flow where the jti (JWT ID) claim uniqueness is not validated. An attacker can replay a previously used JWT assertion multiple times, bypassing the mandatory single-use requirement specified in OpenID Connect. Affected versions prior to 0.31.0 fail to maintain a jti registry or check against it during token validation.
In the same product, most dangerous first.