CVE-2020-28042

Vulnerability

Description ServiceStack before version 5.9.2 mishandles JWT signature verification, allowing tokens with arbitrarily short or empty signatures to be accepted. The root cause is the lack of a minimum length check for the JWT signature portion. According to the release notes [2], a patch was introduced to require a minimum signature size, and a custom ValidateToken function can enforce this in older versions.

Exploitation

An attacker can exploit this by crafting a JWT token with an insufficient signature (e.g., removing or minimizing the signature) and presenting it to any endpoint that relies on JWT authentication. No prior authentication is needed; the attacker only requires network access to the target service. The Shielder blog [4] describes how during a penetration test, simply removing the signature resulted in a 200 OK response from authenticated APIs, confirming the bypass.

Impact

Successful exploitation leads to complete authentication bypass, granting the attacker unauthorized access to all JWT-protected resources. This includes potential access to administrative functions, sensitive data, or arbitrary actions depending on the application's authorization logic. The vulnerability can be used to impersonate any user or escalate privileges system-wide.

Mitigation

The vulnerability is fixed in ServiceStack version 5.9.2 [2]. Users unable to upgrade should implement a custom ValidateToken function that checks the signature length, as demonstrated in the release notes: req.GetJwtToken().LastRightPart('.').FromBase64UrlSafe().Length >= 32. No workaround is provided other than this custom validation. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog as of this writing.