CVE-2020-26160

CVE-2020-26160 is a bypass vulnerability affecting jwt-go versions prior to 4.0.0-preview1. It allows attackers to circumvent access restrictions when the "aud" (audience) claim in a JWT token is an empty string array, leading to an empty string value for "aud" if a service doesn't perform its own audience validation. This vulnerability carries a CVSS score of 7.5 (High) due to its network-based attack vector, low attack complexity, and potential for high confidentiality impact. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.