~ / search / GHSA-599h-8wpj-75xj

GHSA-599h-8wpj-75xj

Authentication Bypass in tyk-identity-broker

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-23365

Packages

EcosystemPackageAffectedFixed in
Go github.com/tyktechnologies/tyk-identity-broker < 1.1.1 1.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).

References

External links from the advisory. They lead to third-party sites.