CVE-2020-26172

PoC —

CVSS 3.1

6.5 medium

EPSS

<1%p50

Published

Dec 18, 2020 (Dec 18, 2020)

Modified

Jun 17, 2026

Description

Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The JWT token does not contain an expiration timestamp.

Vendors: tangro
Products: business workflow
Weakness: CWE-294
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.