{"id":"CVE-2020-1762","aliases":["GHSA-465w-gg5p-85c9","GO-2022-0626"],"url":"https://o3.security/vulnerability/CVE-2020-1762","summary":"Insufficient Session Expiration in Kiali","details":"An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.","published":"2020-04-27T21:15:13.717Z","modified":"2026-07-08T05:54:22.742660246Z","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"},"epss":{"score":0.01125,"percentile":0.63312,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/kiali/kiali","fixedVersion":"1.15.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://kiali.io/news/security-bulletins/kiali-security-001/"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1762"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T05:54:22.742660246Z"}}