CVE-2020-26172

Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The JWT token does not contain an expiration timestamp.
References
Configurations

Configuration 1

cpe:2.3:a:tangro:business_workflow:*:*:*:*:*:*:*:*

Information

Published : 2020-12-18 10:15

Updated : 2020-12-21 09:11


NVD link : CVE-2020-26172

Mitre link : CVE-2020-26172

Products Affected
No products.
CWE
CWE-294

Authentication Bypass by Capture-replay