Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The github.com/nats-io/jwt Go package versions before 1.1.0 mishandle credential expiry, so time-based expiration of credentials does not work. The source does not describe what an attacker must do beyond using expired credentials, and it gives few details on the exact access-control impact. Upgrade github.com/nats-io/jwt to 1.1.0 or later, and upgrade nats-server to 2.1.9 or later if it uses NATS Accounts.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 9.8 | Critical | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS 0.023, the 83rd percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:45 UTC First seen by agentprime
- 31 Oct 2026, 14:45 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-4w5x-x539-ppf5
- OSV: GHSA-4w5x-x539-ppf5
- github.com/nats-io/jwt/security/advisories/GHSA-4w5x-x539-ppf5
- nvd.nist.gov/vuln/detail/CVE-2020-26892
- github.com/nats-io/jwt/commit/e11ce317263cef69619fc1ca743b195d02aa1d8a
- github.com/nats-io/nats-server/commit/1e08b67f08e18cd844dce833a265aaa72500a12f
- advisories.nats.io/CVE/CVE-2020-26892.txt
- github.com/nats-io/jwt
- github.com/nats-io/nats-server/commits/master
- lists.fedoraproject.org/archives/list/[email protected]/message/VT67XCLIIBYRT762SVFBYFFTQFVSM3SI
- pkg.go.dev/vuln/GO-2022-0380
- www.openwall.com/lists/oss-security/2020/11/02/2