GO-2022-0380

    Dashboard / Vulnerabilities / GO-2022-0380

    GO-2022-0380

    Published: 15 Jul 2022Last Modified: 4 Feb 2026

    Summary: Incorrect handling of credential expiry in github.com/nats-io/jwt

    Details: The AccountClaims.IsRevoked and Export.IsRevoked functions improperly validate expired credentials using the current system time rather than the issue time of the JWT to be tested. These functions cannot be used properly. Newer versions of the jwt package provide an IsClaimRevoked method which performs correct validation. In these versions, the IsRevoked method always return true.

    References: https://advisories.nats.io/CVE/CVE-2020-26892.txt, https://github.com/nats-io/jwt/commit/e11ce317263cef69619fc1ca743b195d02aa1d8a

    Affected packages

    Package

    Name: github.com/nats-io/jwt

    Purl: pkg:golang/github.com/nats-io/jwt

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.1.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GO-2022-0380 | CVE-DB