Ignored storage errors on token revokation in ORY Fosite
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8epss 1.6%
exploitation probability
1.6%top 27% of all CVEs
observed exploitation
nono source reports it
In short
A security flaw in ORY Fosite's token revocation feature causes it to report success (HTTP 200) even when the token wasn't actually revoked from storage due to an error. This means attackers could exploit storage failures to keep using tokens that should have been invalidated.
Technical detail
The TokenRevocationHandler fails to properly handle storage errors during token revocation, returning success status codes regardless of whether the revocation persisted to the backend. An attacker who can trigger storage failures may maintain access with revoked tokens; exploitation depends on ability to induce storage layer errors. Fixed in version 0.34.0.
Summary generated and translated by AI from the official description.
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store. This is fixed in version 0.34.0
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected products
ory · fosite