CVE-2020-15084

CVE-2020-15084 is a critical authorization bypass vulnerability affecting the express-jwt NPM package, specifically versions up to and including 5.3.3, when used in conjunction with libraries like jwks-rsa without explicitly configuring the "algorithms" parameter. This vulnerability carries a CVSS score of 9.1 (Critical), indicating a severe risk due to its network-based attack vector, low attack complexity, and high potential for confidentiality and integrity compromise. While the vulnerability is critical, there is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding it.