CVE-2020-28042
Signature validation bypass in ServiceStack
CVE-2020-28042 is a medium vulnerability (CVSS 5.3) in Servicestack, published November 1, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.34%, the 83rd percentile. Fixed in ServiceStack 5.9.2.
ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
- Record
CVE-2020-28042- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
CVE List No score
ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
- Record
CVE-2020-28042- Updated
- 2026-11-02
EUVDEUVD-2021-0516 No score
ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
- Record
EUVD-2021-0516- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v5rv-hpxg-8x49 No score
Signature validation bypass in ServiceStack
ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
- Record
GHSA-v5rv-hpxg-8x49- Weakness
- CWE-347
- Updated
- 2026-11-02
OSV
ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
- Record
CVE-2020-28042- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-v5rv-hpxg-8x49 No score
Signature validation bypass in ServiceStack
ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
- Record
GHSA-v5rv-hpxg-8x49- Weakness
- CWE-347
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ServiceStackNuGet |
before 5.9.2 | 5.9.2 |
ServiceStackNuGet |
before 5.9.2, plus listed versions 2.2.22.9.02.92.02.93.02.95.0 Show 45 moreShow less2.96.03.0.03.0.53.0.63.0.73.0.93.1.03.1.13.1.33.1.63.1.73.2.03.2.13.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.03.3.13.3.23.3.33.3.43.3.53.3.63.3.73.3.83.3.93.4.03.4.13.4.23.4.33.4.83.5.13.5.23.5.33.5.43.5.53.5.73.5.83.5.93.6.0 |
5.9.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | z-bool/Venom-JWT | 2025-01-27 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
forums.servicestack.net/t/servicestack-v5-9-2-released/8850
github.com/ServiceStack/ServiceStack/commit/540d4060e877a03ae95343c1a8560a26768585ee
shielder.it/blog/2020/11/re-discovering-a-jwt-authentication-bypass-in-servicestack
nvd.nist.gov/vuln/detail/CVE-2020-28042
snyk.io/vuln/SNYK-DOTNET-SERVICESTACK-1035519
nuget.org/packages/ServiceStack
Left out here: 136 versions. The JSON record has them.