-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sap-xssec | pip | < 4.1.0 | 4.1.0 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper handling of the JWT audience ('aud') claim. The commit diff shows a critical fix in security_context_ias.py where a string 'aud' value is explicitly converted to a list before validation. Prior to 4.1.0, if a token contained a string-formatted 'aud' claim (permitted by JWT RFC), the validation would fail to properly compare it against allowed audiences, enabling privilege escalation. The vulnerable function was directly responsible for audience validation, and the patch explicitly addresses this handling, making it the clear root cause.
Ongoing coverage of React2Shell