Executive brief
Redirect URL matching ignores character casing
Affected products
- Go github.com/ory/fosite
Junglewise Threat Intelligence
CVE-2020-15234: Redirect URL matching ignores character casing
CVE-2020-15234 · Severity: low · CVSS 3.1 · Published 2021-05-24
Technologies: github.com/ory/fosite (Go). Vendors: Go.
Related threats
- GO-2021-0109 - Improper handling of token revocation in github.com/ory/fosite
- GO-2021-0110 - Token reuse in github.com/ory/fosite
- OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
- GO-2021-0092 - Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed.