cve.bz

CVE-2021-23365

9.1 criticalEPSS 1.0%

Critical (9.1) in tyk tyk-identity-broker. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in github.com/tyktechnologies/tyk-identity-broker 1.1.1.

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).

Severity

CVSS 3.1

9.1 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE
CWE-287
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-599h-8wpj-75xjGogithub.com/tyktechnologies/tyk-identity-broker<1.1.11.1.1
GO-2022-0906Gogithub.com/TykTechnologies/tyk-identity-broker<1.1.11.1.1

References

Check your stackJSON