CVE-2020-15240

omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all of the following conditions apply: 1. You are using `omniauth-auth0`. 2. You are using `JWTValidator.verify` method directly OR you are not authenticating using the SDK’s default Authorization Code Flow. The issue is patched in version 2.4.1.

• CWE-287
• CWE-347
• CWE-347

• https://github.com/auth0/omniauth-auth0/commit/fd3a14f4ccdfbc515d1121d6378ff88bf55a7a7aPatch, Third Party Advisory
• https://github.com/auth0/omniauth-auth0/security/advisories/GHSA-58r4-h6v8-jcvmThird Party Advisory
• https://rubygems.org/gems/omniauth-auth0Product, Vendor Advisory
• https://github.com/auth0/omniauth-auth0/commit/fd3a14f4ccdfbc515d1121d6378ff88bf55a7a7aPatch, Third Party Advisory
• https://github.com/auth0/omniauth-auth0/security/advisories/GHSA-58r4-h6v8-jcvmThird Party Advisory
• https://rubygems.org/gems/omniauth-auth0Product, Vendor Advisory

Published

Oct 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15235In RACTF before commit f3dc89b, unauthenticated users are ab…7.5
• CVE-2020-15236In Wiki.js before version 2.5.151, directory traversal outsi…7.5
• CVE-2020-15237In Shrine before version 3.3.0, when using the `derivation_e…5.9
• CVE-2020-15238Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4…7
• CVE-2020-15239In xmpp-http-upload before version 0.4.0, when the GET metho…3.5
• CVE-2020-1524An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15241TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versi…6.1
• CVE-2020-15242Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Ope…6.1
• CVE-2020-15243Affected versions of Smartstore have a missing WebApi Authen…9.8
• CVE-2020-15244In Magento (rubygems openmage/magento-lts package) before ve…7.2
• CVE-2020-15245In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user m…4.3
• CVE-2020-15246October is a free, open-source, self-hosted CMS platform bas…7.5