{"id":"CVE-2020-19003","aliases":["EUVD-2021-0090","GHSA-q6j2-g8qf-wvf7","PYSEC-2021-423"],"status":"published","title":"Verification check bypass in Gate One","description":"An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00789,"percentile":0.56504,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-290"],"published":"2021-10-06T12:41:19Z","modified":"2026-06-17T02:59:33Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"gateone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"gateone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.0"}]}],"versions":["1.2.0"]},{"source":"osv","ecosystem":"PyPI","package":"gateone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0"]}],"products":[{"vendor":"liftoffsoftware","product":"gate_one"}],"references":[{"url":"https://github.com/liftoff/GateOne/issues/728","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","web","report"]},{"url":"https://cwe.mitre.org/data/definitions/290.html","tags":["x_refsource_MISC","x_transferred","Technical Description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-19003","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q6j2-g8qf-wvf7","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/gateone/PYSEC-2021-423.yaml","tags":["web"]},{"url":"https://github.com/liftoff/GateOne","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-19003","description":"An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list.","status":"published","published":"2021-10-06T12:41:19Z","modified":"2024-08-04T14:08:30.611Z","updated_at":"2026-11-02T14:35:49.879248Z"}],"euvd":[{"id":"EUVD-2021-0090","description":"An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list.","status":"published","published":"2021-10-06T12:41:19Z","modified":"2024-08-04T14:08:30Z","updated_at":"2026-11-03T03:07:25.299661Z"}],"ghsa":[{"id":"GHSA-q6j2-g8qf-wvf7","title":"Verification check bypass in Gate One","description":"An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list.","status":"published","published":"2021-10-12T22:34:28Z","modified":"2024-09-20T21:02:36Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2020-19003","description":"An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list.","status":"published","published":"2021-10-06T13:15:07.267Z","modified":"2026-06-17T02:59:33.11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:06:45.704484Z"}],"osv":[{"id":"GHSA-q6j2-g8qf-wvf7","title":"Verification check bypass in Gate One","description":"An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list.","status":"published","published":"2021-10-12T22:34:28Z","modified":"2024-09-20T21:25:24.014701Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"PYSEC-2021-423","description":"An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list.","status":"published","published":"2021-10-06T13:15:00Z","modified":"2023-11-08T04:02:44.832556Z","updated_at":"2026-11-02T15:52:53.119977Z"}]}}