The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26892
Reference (s):
- https://www.openwall.com/lists/oss-security/2020/11/02/2
- FEDORA:FEDORA-2020-2c8851d48b
- URL: https://lists.fedoraproject.org/archives/list/[email protected]/message/VT67XCLIIBYRT762SVFBYFFTQFVSM3SI/
- https://github.com/nats-io/nats-server/commits/master