GHSA-599h-8wpj-75xj

    Dashboard / Vulnerabilities / GHSA-599h-8wpj-75xj

    GHSA-599h-8wpj-75xj

    Published: 23 Jun 2021Last Modified: 8 Jul 2026

    Summary: Authentication Bypass in tyk-identity-broker

    Details: The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).

    References: https://nvd.nist.gov/vuln/detail/CVE-2021-23365, https://github.com/TykTechnologies/tyk-identity-broker/pull/147, https://github.com/TykTechnologies/tyk-identity-broker/commit/243092965b0f93a95a14cb882b5b9a3df61dd5c0, https://github.com/TykTechnologies/tyk-identity-broker/commit/46f70420e0911e4e8b638575e29d394c227c75d0, https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.1.1, https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMTYKTECHNOLOGIESTYKIDENTITYBROKER-1089720

    Affected packages

    Package

    Name: github.com/tyktechnologies/tyk-identity-broker

    Purl: pkg:golang/github.com/tyktechnologies/tyk-identity-broker

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.1.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-599h-8wpj-75xj | CVE-DB