CVE-2020-15957

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-30 · updated 2026-06-17
Weakness: CWE-347

Description

An issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing (DP3T). When it is configured to check JWT before uploading/publishing keys, it is possible to skip the signature check by providing a JWT token with alg=none.

Affected products

Dp3T-Backend-Software Development Kit Project Dp3T-Backend-Software Development Kit: before 1.1.1 — fixed in 1.1.1

How to fix

Upgrade to a fixed version: Dp3T-Backend-Software Development Kit Project Dp3T-Backend-Software Development Kit 1.1.1. Check the vendor advisory for mitigations.

References

https://github.com/DP-3T/dp3t-sdk-backend/compare/v1.0.4...v1.1.0
https://github.com/DP-3T/dp3t-sdk-backend/security/advisories/GHSA-5m5q-3qw2-3xf3
https://github.com/dp-3T/dp3t-sdk-backend
https://github.com/DP-3T/dp3t-sdk-backend/compare/v1.0.4...v1.1.0
https://github.com/DP-3T/dp3t-sdk-backend/security/advisories/GHSA-5m5q-3qw2-3xf3
https://github.com/dp-3T/dp3t-sdk-backend

Get alerted when CVE-2020-15957 or the next vulnerability affects your stack