github.com/ory/fosite
View on Github
Activity
- Latest release
- 1y ago
- Total releases
- 63
- Cadence
- ~37 days
- Last 12 months
- 0
Reach
- Stars
- —
Details
- First release
- Aug 01, 2016
| Version | Released | |
|---|---|---|
v0.49.0
minor
|
v0.49.0
minor
Dependencies (25)
+ 17 more |
|
v0.48.0
minor
|
v0.48.0
minor
Dependencies (25)
+ 17 more |
|
v0.47.0
minor
|
v0.47.0
minor
Dependencies (25)
+ 17 more |
|
v0.46.1
patch
|
v0.46.1
patch
Dependencies (26)
+ 18 more |
|
v0.46.0
minor
|
v0.46.0
minor
Dependencies (26)
+ 18 more |
|
v0.45.0
minor
|
v0.45.0
minor
Dependencies (26)
+ 18 more |
|
v0.44.0
minor
|
v0.44.0
minor
Dependencies (25)
+ 17 more |
|
v0.43.0
minor
|
v0.43.0
minor
Dependencies (25)
+ 17 more |
|
v0.42.2
patch
|
v0.42.2
patch
Dependencies (20)
+ 12 more |
|
v0.42.1
minor
|
v0.42.1
minor
Dependencies (20)
+ 12 more |
|
v0.42.0
minor
|
v0.42.0
minor
Dependencies (20)
+ 12 more |
|
v0.41.0
minor
|
v0.41.0
minor
Dependencies (20)
+ 12 more |
|
v0.40.2
patch
|
v0.40.2
patch
Dependencies (19)
+ 11 more |
|
v0.40.1
patch
|
v0.40.1
patch
Dependencies (19)
+ 11 more |
|
v0.40.0
minor
|
v0.40.0
minor
Dependencies (19)
+ 11 more |
|
v0.39.0
minor
|
v0.39.0
minor
Dependencies (20)
+ 12 more |
|
v0.38.0
minor
|
v0.38.0
minor
Dependencies (20)
+ 12 more |
|
v0.37.0
minor
|
v0.37.0
minor
Dependencies (20)
+ 12 more |
|
v0.36.1
minor
|
v0.36.1
minor
Dependencies (20)
+ 12 more |
|
v0.36.0
minor
|
v0.36.0
minor
Dependencies (20)
+ 12 more |
|
v0.35.0
minor
|
v0.35.0
minor
Dependencies (18)
+ 10 more |
|
v0.34.1
minor
|
v0.34.1
minor
Dependencies (18)
+ 10 more |
|
v0.32.0
minor
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15233
GHSA-rfq3-w54c-f9q5
May 24, 2021
OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Impactfosite#400 (released as v0.30.2) introduced a new feature for handling redirect URLs pointing to loopback interfaces (rfc8252#section-7.3). As part of that change new behavior was introduced which failed to respect the redirect URL's (only for loopback interfaces!) query parameters
as well as the host parameter (as long as the host is a loopback interface):
These bugs are only applicable in scenarios where the attacker has control over the loopback interface ( Fixed in
0.34.1
References Updated Jul 08, 2026 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.32.0
minor
Dependencies (17)
+ 9 more |
|
v0.31.2
patch
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15233
GHSA-rfq3-w54c-f9q5
May 24, 2021
OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Impactfosite#400 (released as v0.30.2) introduced a new feature for handling redirect URLs pointing to loopback interfaces (rfc8252#section-7.3). As part of that change new behavior was introduced which failed to respect the redirect URL's (only for loopback interfaces!) query parameters
as well as the host parameter (as long as the host is a loopback interface):
These bugs are only applicable in scenarios where the attacker has control over the loopback interface ( Fixed in
0.34.1
References Updated Jul 08, 2026 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.31.2
patch
Dependencies (17)
+ 9 more |
|
v0.31.0
minor
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15233
GHSA-rfq3-w54c-f9q5
May 24, 2021
OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Impactfosite#400 (released as v0.30.2) introduced a new feature for handling redirect URLs pointing to loopback interfaces (rfc8252#section-7.3). As part of that change new behavior was introduced which failed to respect the redirect URL's (only for loopback interfaces!) query parameters
as well as the host parameter (as long as the host is a loopback interface):
These bugs are only applicable in scenarios where the attacker has control over the loopback interface ( Fixed in
0.34.1
References Updated Jul 08, 2026 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.31.0
minor
Dependencies (15)
+ 7 more |
|
v0.30.4
patch
4 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15233
GHSA-rfq3-w54c-f9q5
May 24, 2021
OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
Impactfosite#400 (released as v0.30.2) introduced a new feature for handling redirect URLs pointing to loopback interfaces (rfc8252#section-7.3). As part of that change new behavior was introduced which failed to respect the redirect URL's (only for loopback interfaces!) query parameters
as well as the host parameter (as long as the host is a loopback interface):
These bugs are only applicable in scenarios where the attacker has control over the loopback interface ( Fixed in
0.34.1
References Updated Jul 08, 2026 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.30.4
patch
Dependencies (15)
+ 7 more |
|
v0.30.2
patch
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.30.2
patch
Dependencies (15)
+ 7 more |
|
v0.30.1
patch
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.30.1
patch
Dependencies (15)
+ 7 more |
|
v0.30.0
minor
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.30.0
minor
Dependencies (15)
+ 7 more |
|
v0.29.5
patch
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.29.5
patch
Dependencies (15)
+ 7 more |
|
v0.29.1
patch
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.29.1
patch
Dependencies (15)
+ 7 more |
|
v0.29.0
minor
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.29.0
minor
Dependencies (15)
+ 7 more |
|
v0.28.0
minor
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.28.0
minor
Dependencies (16)
+ 8 more |
|
v0.21.3
minor
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.21.3
minor
|
|
v0.20.3
minor
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.20.3
minor
|
|
v0.19.4
patch
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.19.4
patch
|
|
v0.19.2
minor
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.19.2
minor
|
|
v0.17.2
patch
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.17.2
patch
|
|
v0.17.0
minor
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.17.0
minor
|
|
v0.16.2
patch
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.16.2
patch
|
|
v0.16.1
patch
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.16.1
patch
|
|
v0.16.0
minor
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.16.0
minor
|
|
v0.15.6
patch
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.15.6
patch
|
|
v0.15.3
patch
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.15.3
patch
|
|
v0.15.1
minor
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.15.1
minor
|
|
v0.13.0
minor
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.13.0
minor
|
|
v0.11.4
patch
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.11.4
patch
|
|
v0.11.3
patch
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.11.3
patch
|
|
v0.11.2
patch
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.11.2
patch
|
|
v0.11.1
minor
3 CVEs
CVE-2020-15223
GO-2021-0109
GHSA-7mqr-2v3q-v2wm
Jul 28, 2021
Improper handling of token revocation in github.com/ory/fosite Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage. Fixed in
0.34.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15222
GO-2021-0110
GHSA-v3q9-2p3m-7g43
Jul 28, 2021
Token reuse in github.com/ory/fosite Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be replayed. Fixed in
0.31.0
Updated May 20, 2024 · Source: OSV.dev
CVE-2020-15234
GHSA-grfp-q2mm-hfp6
May 24, 2021
Redirect URL matching ignores character casing
6.1
/ 10
Medium
Network
Low
High
Required
Unchanged
High
High
None
ImpactBefore version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using
Fixed in
0.34.1
References Updated Sep 10, 2026 · Source: OSV.dev |
v0.11.1
minor
|