CVE-2020-5300

CVE-2020-5300 affects Ory Hydra, an OAuth2 server, allowing for replay attacks when using the 'private_key_jwt' client authentication method. The vulnerability stems from Hydra's failure to enforce the uniqueness of the 'jti' assertion in JWTs, which is intended to prevent token reuse. While the CVSS score is Medium (5.3), exploitation is difficult due to TLS protection and the short expiry window of JWTs, limiting the impact to potential information disclosure. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.