{"cve":"CVE-2020-15240","nvd":{"published":"2020-10-21T18:15:12.813","modified":"2026-06-17T02:56:20.360","status":"Modified","description":"omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all of the following conditions apply: 1. You are using `omniauth-auth0`. 2. You are using `JWTValidator.verify` method directly OR you are not authenticating using the SDK’s default Authorization Code Flow. The issue is patched in version 2.4.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1},"cwes":["CWE-347","CWE-287"],"references":["https://github.com/auth0/omniauth-auth0/commit/fd3a14f4ccdfbc515d1121d6378ff88bf55a7a7a","https://github.com/auth0/omniauth-auth0/security/advisories/GHSA-58r4-h6v8-jcvm","https://rubygems.org/gems/omniauth-auth0","https://github.com/auth0/omniauth-auth0/commit/fd3a14f4ccdfbc515d1121d6378ff88bf55a7a7a","https://github.com/auth0/omniauth-auth0/security/advisories/GHSA-58r4-h6v8-jcvm"],"products":["auth0:omniauth-auth0"],"source":"nvd","synced_at":"2026-10-19T21:09:53.489947993+00:00"},"epss":{"cve":"CVE-2020-15240","score":0.00803,"percentile":0.5671,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-58r4-h6v8-jcvm","url":"https://osv.dev/vulnerability/GHSA-58r4-h6v8-jcvm","summary":"Regression in JWT Signature Validation","modified":"2026-07-08T05:59:47.963127968Z","packages":[{"ecosystem":"RubyGems","name":"omniauth-auth0","purl":"pkg:gem/omniauth-auth0","ranges":[">=2.3.0 <2.4.1"],"fixed":["2.4.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}