{"id":"CVE-2020-15084","aliases":["CLSA-2026-1774570939","CLSA-2026-1774570940","EUVD-2020-0463","GHSA-6g6m-m6h5-w9gf","ROOT-APP-NPM-CVE-2020-15084"],"status":"published","title":"Authorization bypass in express-jwt","description":"In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the **secret**. You can fix this by specifying **algorithms** in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01221,"percentile":0.69088,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285","CWE-863"],"published":"2020-06-30T16:05:24Z","modified":"2026-10-20T10:52:47Z","fixes":[{"ecosystem":"npm","package":"express-jwt","fixed_in":["6.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"express-jwt","fixed_in":["0.1.4-tuxcare.1","0.1.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/express-jwt","fixed_in":["0.1.3-root.io.1","0.1.3-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"express-jwt","fixed_in":["0.1.3-aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"express-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.3.3"},{"fixed":"6.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"express-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.4-tuxcare.0"},{"fixed":"0.1.4-tuxcare.1"}]}],"versions":["0.1.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"express-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.3-tuxcare.0"},{"fixed":"0.1.3-tuxcare.1"}]}],"versions":["0.1.3"]},{"source":"osv","ecosystem":"npm","package":"express-jwt","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.0.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/express-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.3-root.io.1"},{"fixed":"0.1.3-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"express-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.3-aikido.2"}]}]}],"products":[{"vendor":"auth0","product":"express-jwt"}],"references":[{"url":"https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15084","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6g6m-m6h5-w9gf"}],"sources":{"cve":[{"id":"CVE-2020-15084","title":"Authorization bypass in express-jwt","description":"In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the **secret**. You can fix this by specifying **algorithms** in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.","status":"published","published":"2020-06-30T16:10:12Z","modified":"2024-08-04T13:08:21.793Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2020-0463","description":"In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the **secret**. You can fix this by specifying **algorithms** in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.","status":"published","published":"2020-06-30T16:10:12Z","modified":"2024-08-04T13:08:21Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:07:33.100327Z"}],"ghsa":[{"id":"GHSA-6g6m-m6h5-w9gf","title":"Authorization bypass in express-jwt","description":"### Overview\nVersions before and including 5.3.3, we are not enforcing the **algorithms** entry to be specified in the configuration.\nWhen **algorithms** is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. \n\n### Am I affected?\nYou are affected by this vulnerability if all of the following conditions apply:\n\nYou are using express-jwt\nAND \nYou do not have **algorithms**  configured in your express-jwt configuration.\nAND\nYou are using libraries such as jwks-rsa as the **secret**. \n\n### How to fix that?\nSpecify **algorithms** in the express-jwt configuration. The following is an example of a proper configuration\n\n``` \nconst checkJwt = jwt({\n  secret: jwksRsa.expressJwtSecret({\n    rateLimit: true,\n    jwksRequestsPerMinute: 5,\n    jwksUri: `https://${DOMAIN}/.well-known/jwks.json`\n  }),\n  // Validate the audience and the issuer.\n  audience: process.env.AUDIENCE,\n  issuer: `https://${DOMAIN}/`,\n  // restrict allowed algorithms\n  algorithms: ['RS256']\n}); \n```\n\n### Will this update impact my users?\nThe fix provided in patch will not affect your users if you specified the algorithms allowed. The patch now makes **algorithms** a required configuration. \n\n\n### Credit\nIST Group","status":"published","published":"2020-06-30T16:05:24Z","modified":"2023-02-02T05:04:02Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T14:36:40.500292Z"}],"nvd":[{"id":"CVE-2020-15084","description":"In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the **secret**. You can fix this by specifying **algorithms** in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.","status":"published","published":"2020-06-30T16:15:15.22Z","modified":"2026-06-17T02:56:01.577Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"CVE-2020-15084","description":"In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the **secret**. You can fix this by specifying **algorithms** in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.","status":"published","published":"2020-06-30T16:15:15.22Z","modified":"2026-10-20T10:52:47.755446557Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"GHSA-6g6m-m6h5-w9gf","title":"Authorization bypass in express-jwt","description":"### Overview\nVersions before and including 5.3.3, we are not enforcing the **algorithms** entry to be specified in the configuration.\nWhen **algorithms** is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. \n\n### Am I affected?\nYou are affected by this vulnerability if all of the following conditions apply:\n\nYou are using express-jwt\nAND \nYou do not have **algorithms**  configured in your express-jwt configuration.\nAND\nYou are using libraries such as jwks-rsa as the **secret**. \n\n### How to fix that?\nSpecify **algorithms** in the express-jwt configuration. The following is an example of a proper configuration\n\n``` \nconst checkJwt = jwt({\n  secret: jwksRsa.expressJwtSecret({\n    rateLimit: true,\n    jwksRequestsPerMinute: 5,\n    jwksUri: `https://${DOMAIN}/.well-known/jwks.json`\n  }),\n  // Validate the audience and the issuer.\n  audience: process.env.AUDIENCE,\n  issuer: `https://${DOMAIN}/`,\n  // restrict allowed algorithms\n  algorithms: ['RS256']\n}); \n```\n\n### Will this update impact my users?\nThe fix provided in patch will not affect your users if you specified the algorithms allowed. The patch now makes **algorithms** a required configuration. \n\n\n### Credit\nIST Group","status":"published","published":"2020-06-30T16:05:24Z","modified":"2026-07-08T06:28:48.938804748Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"CLSA-2026-1774570939","title":"TuxCare security update for express-jwt (1 CVE)","description":"TuxCare rebuilt express-jwt to address 1 CVE. Fixed in 0.1.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.134154335Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774570940","title":"TuxCare security update for express-jwt (1 CVE)","description":"TuxCare rebuilt express-jwt to address 1 CVE. Fixed in 0.1.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.135342776Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"ROOT-APP-NPM-CVE-2020-15084","title":"CVE-2020-15084 in @rootio/express-jwt - Patched by Root","description":"Root has patched CVE-2020-15084 in the @rootio/express-jwt package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T19:40:58Z","modified":"2026-06-05T01:30:04.190347726Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}