CVE-2020-36255

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in IdentityModel (aka ScottBrady.IdentityModel) before 1.3.0. The Branca implementation allows an attacker to modify and forge authentication tokens.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/scottbrady91/IdentityModel/compare/1.2.0...1.3.0Patch, Release Notes, Third Party Advisory
https://github.com/scottbrady91/IdentityModel/issues/3Broken Link, Issue Tracking, Third Party Advisory
https://github.com/scottbrady91/IdentityModel/issues/4Broken Link, Issue Tracking, Third Party Advisory
https://github.com/scottbrady91/IdentityModel/compare/1.2.0...1.3.0Patch, Release Notes, Third Party Advisory
https://github.com/scottbrady91/IdentityModel/issues/3Broken Link, Issue Tracking, Third Party Advisory
https://github.com/scottbrady91/IdentityModel/issues/4Broken Link, Issue Tracking, Third Party Advisory

Timeline

Published: Mar 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-36267.8Any application can bind to it and exercise the APIs due to no protection for AIDL uimlpaservice in Snapdragon Auto, Snapdragon Compute, Sna CVE-2020-362777.5Leptonica before 1.80.0 allows a denial of service (application crash) via an incorrect left shift in pixConvert2To8 in pixconv.c.CVE-2020-362787.5Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c.CVE-2020-362797.5Leptonica before 1.80.0 allows a heap-based buffer over-read in rasteropGeneralLow, related to adaptmap_reg.c and adaptmap.c.CVE-2020-36289.8Improper access due to socket opened by the logging application without specifying localhost address in Snapdragon Consumer IOT, Snapdragon CVE-2020-362807.5Leptonica before 1.80.0 allows a heap-based buffer over-read in pixReadFromTiffStream, related to tiffio.c.CVE-2020-362817.5Leptonica before 1.80.0 allows a heap-based buffer over-read in pixFewColorsOctcubeQuantMixed in colorquant1.c.CVE-2020-362829.8JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via CVE-2020-362838.8HID OMNIKEY 5427 and OMNIKEY 5127 readers are vulnerable to CSRF when using the EEM driver (Ethernet Emulation Mode). By persuading an authe CVE-2020-362847.5Union Pay up to 3.4.93.4.9, for android, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attacker CVE-2020-362857.5Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows atta CVE-2020-362865.3The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from v