{"id":"CVE-2024-5798","aliases":["BIT-vault-2024-5798","EUVD-2024-1892","GHSA-32cj-5wx4-gq8p","GO-2024-2921"],"status":"published","title":"Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims","description":"Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected.\n\nThis vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9","severity":{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00343,"percentile":0.28089,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285","CWE-287"],"published":"2024-06-12T18:55:24Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/vault","fixed_in":["1.17.0","1.16.3","1.15.9"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"vault","fixed_in":["1.16.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0-rc1"},{"last_affected":"1.17.0-rc1"},{"fixed":"1.17.0"}]}],"versions":["1.17.0-rc1"]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0-rc1"},{"fixed":"1.16.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.0"},{"fixed":"1.15.9"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"vault","ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0"},{"fixed":"1.16.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.17.0-rc1"},{"fixed":"1.17.0"}]}],"versions":["1.17.0-rc1"]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.16.0-rc1"},{"fixed":"1.16.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0"},{"fixed":"1.15.9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"0.11.0"},{"fixed":"1.16.3"},{"introduced":"1.17.0-rc1"},{"fixed":"1.17.0"}]}]}],"products":[{"vendor":"hashicorp","product":"vault"},{"vendor":"hashicorp","product":"vault enterprise"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2024-11-vault-incorrectly-validated-json-web-tokens-jwt-audience-claims/67770","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5798","tags":["web","advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2921","tags":["web"]},{"url":"https://github.com/advisories/GHSA-32cj-5wx4-gq8p","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5798.json","tags":["advisory"]},{"url":"https://github.com/hashicorp/vault","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-5798","title":"Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims","description":"Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected.\n\nThis vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9","status":"published","published":"2024-06-12T18:55:24.788Z","modified":"2025-11-04T16:30:51.697Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:01.630882Z"}],"euvd":[{"id":"EUVD-2024-1892","description":"Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected.\n\nThis vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9","status":"published","published":"2024-06-12T18:55:24Z","modified":"2025-11-04T16:30:51Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T19:49:28.381167Z"}],"ghsa":[{"id":"GHSA-32cj-5wx4-gq8p","title":"HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims","description":"Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected.\n\nThis vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9","status":"published","published":"2024-06-12T21:31:19Z","modified":"2025-08-07T18:20:38Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:38:52.85141Z"}],"nvd":[{"id":"CVE-2024-5798","description":"Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected.\n\nThis vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9","status":"published","published":"2024-06-12T19:15:51.413Z","modified":"2026-06-17T08:16:40.123Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:10:04.804473Z"}],"osv":[{"id":"CVE-2024-5798","title":"Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims","description":"Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected.\n\nThis vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9","status":"published","published":"2024-06-12T18:55:24.788Z","modified":"2026-10-28T02:30:33.685478126Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:44:45.107804Z"},{"id":"GHSA-32cj-5wx4-gq8p","title":"HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims","description":"Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected.\n\nThis vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9","status":"published","published":"2024-06-12T21:31:19Z","modified":"2026-08-07T08:12:02.36427233Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"BIT-vault-2024-5798","title":"Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims","description":"Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected.\n\nThis vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9","status":"published","published":"2024-06-17T07:39:45.639Z","modified":"2026-09-08T08:48:21.274102654Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"GO-2024-2921","title":"HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims in github.com/hashicorp/vault","description":"HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims in github.com/hashicorp/vault.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/hashicorp/vault before v1.15.9.","status":"published","published":"2024-07-01T19:59:12Z","modified":"2026-08-07T08:12:33.434371586Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}