CVE-2022-39304
ghinstallation returns app JWT in error responses
ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum). This issue has been patched and is available in version 2.0.0.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
ghinstallation returns app JWT in error responses
ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum). This issue has been patched and is available in version 2.0.0.
- Record
CVE-2022-39304- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L - Weakness
- CWE-209
- Updated
- 2026-11-02
EUVDEUVD-2022-7643
ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum). This issue has been patched and is available in version 2.0.0.
- Record
EUVD-2022-7643- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h4q8-96p6-jcgr
ghinstallation returns app JWT in error responses
Impact
In ghinstallation v1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging.
The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum).
Patches
- This has already been patched in d24f14f8be70d94129d76026e8b0f4f9170c8c3e, and is available in releases >= v2.0.0.
References
Are there any links users can visit to find out more?
- See https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps#authenticating-as-an-installation for the App installation flow.
For more information
If you have any questions or comments about this advisory:
- Open an issue in ghinstallation
- Record
GHSA-h4q8-96p6-jcgr- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L - Weakness
- CWE-209
- Updated
- 2026-11-02
NVD
ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum). This issue has been patched and is available in version 2.0.0.
- Record
CVE-2022-39304- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L - CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSV
ghinstallation returns app JWT in error responses
ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum). This issue has been patched and is available in version 2.0.0.
- Record
CVE-2022-39304- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L - Weakness
- CWE-209
- Updated
- 2026-11-02
OSVGHSA-h4q8-96p6-jcgr
ghinstallation returns app JWT in error responses
Impact
In ghinstallation v1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging.
The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum).
Patches
- This has already been patched in d24f14f8be70d94129d76026e8b0f4f9170c8c3e, and is available in releases >= v2.0.0.
References
Are there any links users can visit to find out more?
- See https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps#authenticating-as-an-installation for the App installation flow.
For more information
If you have any questions or comments about this advisory:
- Open an issue in ghinstallation
- Record
GHSA-h4q8-96p6-jcgr- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L - Weakness
- CWE-209
- Updated
- 2026-11-02
OSVGO-2022-1178 No score
JWT leak in github.com/bradleyfalzon/ghinstallation
Errors returned by ghinstallation.Transport can include the JWT used for the failed operation. If the error is exposed to an untrusted party, this JWT could be extracted and used to authenticate further requests.
- Record
GO-2022-1178- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/bradleyfalzon/ghinstallationGo |
before 2.0.0 | 2.0.0 |
github.com/bradleyfalzon/ghinstallationGo |
before 1.1.2-0.20210308182858-d24f14f8be70 | 1.1.2-0.20210308182858-d24f14f8be70 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-39304 is a medium vulnerability (CVSS 5.0) in Bradleyfalzon Ghinstallation, published December 19, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in github.com/bradleyfalzon/ghinstallation 2.0.0.
References
github.com/bradleyfalzon/ghinstallation/security/advisories/GHSA-h4q8-96p6-jcgr
docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps
nvd.nist.gov/vuln/detail/CVE-2022-39304
securitylab.github.com/advisories/GHSL-2022-061_ghinstallation