GHSA-2c64-vj8g-vwrq: Github.com/nats io/nats server/v2 Incorrect Handling Of Credential Expiry Vulnerability

HIGH
Share
CWE-284
Published
Advisory Summary

GHSA-2c64-vj8g-vwrq is a HIGH incorrect handling of credential expiry vulnerability (CWE-284: Improper Access Control) affecting Github.com/nats io/nats server/v2 libraries in the Go ecosystem. The issue involves incorrect handling of credential expiry by /nats-io/nats-server. Remediation is available by upgrading affected packages to version 2.1.9.

GHSA-2c64-vj8g-vwrq at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-2c64-vj8g-vwrq
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-284: Improper Access Control
Affected Product Github.com/nats io/nats server/v2
Package Ecosystem Go
Published Date
Last Updated

How to Fix GHSA-2c64-vj8g-vwrq

To remediate this vulnerability, upgrade all affected Github.com/nats io/nats server/v2 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/nats-io/nats-server/v2 fixed: 2.1.9 
Upgrade github.com/nats-io/nats-server/v2 to 2.1.9
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/nats-io/nats-server/v2

How to Check if You Are Affected

To determine whether your application is affected by GHSA-2c64-vj8g-vwrq, inspect your project dependencies for Github.com/nats io/nats server/v2:

inspect dependencies for github.com/nats-io/nats-server/v2

Analyze the terminal output to locate any version of Github.com/nats io/nats server/v2 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.1.9), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-284: Improper Access Control, where the product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. In Github.com/nats io/nats server/v2, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

(This advisory is canonically https://advisories.nats.io/CVE/CVE-2020-26892.txt ) ## Problem Description NATS nats-server through 2020-10-07 has Incorrect Access Control because of how expired credentials are handled. The NATS accounts system has expiration timestamps on credentials; the <https://github.com/nats-io/jwt> library had an API which encouraged misuse and an `IsRevoked()` method which misused its own API. A new `IsClaimRevoked()` method has correct handling and the nats-server has been updated to use this. The old `IsRevoked()` method now always returns true and other client code will have to be updated to avoid calling it. The CVE identifier should cover any application using the old JWT API, where the nats-server is one of those applications. ## Affected versions #### JWT library * all versions prior to 1.1.0 * fixed after nats-io/jwt PR 103 landed (2020-10-06) #### NATS Server * Version 2 prior to 2.1.9 + 2.0.0 through and including 2.1.8 are vulnerable. * fixed with nats-io/nats-server PRs 1632, 1635, 1645 ## Impact Time-based credential expiry did not work. ## Workaround Have credentials which only expire after fixes can be deployed. ## Solution Upgrade the JWT dependency in any application using it. Upgrade the NATS server if using NATS Accounts.

GHSA-2c64-vj8g-vwrq Affected Github.com/nats io/nats server/v2 Versions

1 component(s)
Fixed Versions:
2.1.9
Product / Package Ecosystem Affected Versions Fixed Version
github.com/nats-io/nats-server/v2
golang/github.com/nats-io/nats-server/v2
Go
< 2.1.9
2.1.9

References

GitHub Advisory / Wiki ADVISORY
https://github.com/nats-io/nats-server/security/advisories/GHSA-2c64-vj8g-vwrq
Security Fix Commit FIX COMMIT
https://github.com/nats-io/jwt/commit/e11ce317263cef69619fc1ca743b195d02aa1d8a
advisories.nats.io/cve/cve-2020-26892.... WEB
https://advisories.nats.io/CVE/CVE-2020-26892.txt
Github.com/nats io/nats server/v2 Source Repository REPOSITORY
https://github.com/nats-io/nats-server

Frequently Asked Questions

What is GHSA-2c64-vj8g-vwrq?
GHSA-2c64-vj8g-vwrq is a security vulnerability in Github.com/nats io/nats server/v2 involving Incorrect handling of credential expiry by /nats-io/nats-server under CWE-284: Improper Access Control.
Which Github.com/nats io/nats server/v2 versions are affected?
Affected versions include releases prior to 2.1.9 across affected packages: github.com/nats-io/nats-server/v2.
What version fixes GHSA-2c64-vj8g-vwrq?
Upgrading to 2.1.9 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/nats-io/nats-server/v2 affected?
Yes, github.com/nats-io/nats-server/v2 is affected in releases prior to 2.1.9. Upgrade your dependency to 2.1.9 or later.
What CWE is associated with GHSA-2c64-vj8g-vwrq?
GHSA-2c64-vj8g-vwrq is classified under CWE-284: Improper Access Control (The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.).
How can I check Go dependencies for GHSA-2c64-vj8g-vwrq?
Run the dependency tree command: 'inspect dependencies for github.com/nats-io/nats-server/v2'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2c64-vj8g-vwrq",
  "modified" : "2025-10-03T19:21:51Z",
  "published" : "2021-05-21T16:11:49Z",
  "aliases" : [ ],
  "summary" : "Incorrect handling of credential expiry by /nats-io/nats-server",
  "details" : "(This advisory is canonically https://advisories.nats.io/CVE/CVE-2020-26892.txt )\n\n## Problem Description\n\nNATS nats-server through 2020-10-07 has Incorrect Access Control because of how expired credentials are handled.\n\nThe NATS accounts system has expiration timestamps on credentials; the <https://github.com/nats-io/jwt> library had an API which encouraged misuse and an `IsRevoked()` method which misused its own API.\n\nA new `IsClaimRevoked()` method has correct handling and the nats-server has been updated to use this.  The old `IsRevoked()` method now always returns true and other client code will have to be updated to avoid calling it.\n\nThe CVE identifier should cover any application using the old JWT API, where the nats-server is one of those applications.\n\n\n## Affected versions\n\n#### JWT library\n\n * all versions prior to 1.1.0\n * fixed after nats-io/jwt PR 103 landed (2020-10-06)\n\n#### NATS Server\n\n * Version 2 prior to 2.1.9\n   + 2.0.0 through and including 2.1.8 are vulnerable.\n * fixed with nats-io/nats-server PRs 1632, 1635, 1645\n\n\n## Impact\n\nTime-based credential expiry did not work.\n\n\n## Workaround\n\nHave credentials which only expire after fixes can be deployed.\n\n\n## Solution\n\nUpgrade the JWT dependency in any application using it.\n\nUpgrade the NATS server if using NATS Accounts.",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/nats-io/nats-server/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.1.9"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/nats-io/nats-server/security/advisories/GHSA-2c64-vj8g-vwrq"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nats-io/jwt/commit/e11ce317263cef69619fc1ca743b195d02aa1d8a"
  }, {
    "type" : "WEB",
    "url" : "https://advisories.nats.io/CVE/CVE-2020-26892.txt"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/nats-io/nats-server"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-284" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2021-05-20T22:19:22Z",
    "nvd_published_at" : null
  }
}