{"cve":"CVE-2020-5300","nvd":{"published":"2020-04-06T17:15:13.367","modified":"2026-06-17T03:21:14.010","status":"Modified","description":"In Hydra (an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go), before version 1.4.0+oryOS.17, when using client authentication method 'private_key_jwt' [1], OpenId specification says the following about assertion `jti`: \"A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated between the parties\". Hydra does not check the uniqueness of this `jti` value. Exploiting this vulnerability is somewhat difficult because: - TLS protects against MITM which makes it difficult to intercept valid tokens for replay attacks - The expiry time of the JWT gives only a short window of opportunity where it could be replayed This has been patched in version v1.4.0+oryOS.17","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.3},"cwes":["CWE-294"],"references":["https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3","https://github.com/ory/hydra/releases/tag/v1.4.0","https://github.com/ory/hydra/security/advisories/GHSA-3p3g-vpw6-4w66","https://github.com/ory/hydra/commit/700d17d3b7d507de1b1d459a7261d6fb2571ebe3","https://github.com/ory/hydra/releases/tag/v1.4.0"],"products":["ory:hydra"],"source":"nvd","synced_at":"2026-10-19T21:03:08.679916934+00:00"},"epss":{"cve":"CVE-2020-5300","score":0.01028,"percentile":0.63653,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-3p3g-vpw6-4w66","url":"https://osv.dev/vulnerability/GHSA-3p3g-vpw6-4w66","summary":"Authentication Bypass in hydra","modified":"2026-07-08T06:28:27.094037366Z","packages":[{"ecosystem":"Go","name":"github.com/ory/hydra","purl":"pkg:golang/github.com/ory/hydra","ranges":["<1.4.0"],"fixed":["1.4.0"]}]},{"id":"GO-2022-0786","url":"https://osv.dev/vulnerability/GO-2022-0786","summary":"Authentication Bypass in hydra in github.com/ory/hydra","modified":"2026-03-03T04:52:15.851817Z","packages":[{"ecosystem":"Go","name":"github.com/ory/hydra","purl":"pkg:golang/github.com/ory/hydra","ranges":["<1.4.0"],"fixed":["1.4.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}