VULNERABILITY INTELLIGENCE

CVE-2020-11020

CVSS score8.5 HIGH

EPSS probability1.57%

CISA KEVNot currently listed

Published2020-04-29

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Description

Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It is patched in versions 1.0.4, 1.1.3 and 1.2.5.

Weakness classification

security-advisories@github.com: CWE-287
nvd@nist.gov: CWE-287

Primary references

security-advisories@github.com — Patch, Third Party Advisory
security-advisories@github.com — Exploit, Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mitigation, Third Party Advisory