{"id":"CVE-2020-11020","details":"Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It is patched in versions 1.0.4, 1.1.3 and 1.2.5.","aliases":["GHSA-qpg4-4w7w-2mq5"],"modified":"2026-10-20T10:51:12.069560818Z","published":"2020-04-29T18:15:13.360Z","database_specific":{},"references":[{"type":"FIX","url":"https://github.com/faye/faye/commit/65d297d341b607f3cb0b5fa6021a625a991cc30e"},{"type":"EVIDENCE","url":"https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/faye/faye","events":[{"introduced":"0"},{"fixed":"72a8dac064824fce0cd3558117e1e6402ce0464b"},{"introduced":"020cf7ca9071c2a4d9c54f1676449de7a4a2069d"},{"fixed":"294f0852e49afde57a1330d0fa26e445e02342f9"},{"introduced":"216ea3333d7bc0fd7f6c6d25e6eb0815b259ec73"},{"fixed":"e459ff1c5c30ce776d1c5747e5f641f081d3a436"},{"fixed":"65d297d341b607f3cb0b5fa6021a625a991cc30e"}],"database_specific":{"extracted_events":[{"source":"CPE_RANGE","cpe":"cpe:2.3:a:faye_project:faye:*:*:*:*:*:node.js:*:*","range":[{"introduced":"0"},{"fixed":"1.0.4"}]},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:faye_project:faye:*:*:*:*:*:ruby:*:*","range":[{"introduced":"0"},{"fixed":"1.0.4"}]},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:faye_project:faye:*:*:*:*:*:node.js:*:*","range":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}]},{"range":[{"introduced":"1.1.0"},{"fixed":"1.1.3"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:faye_project:faye:*:*:*:*:*:ruby:*:*"},{"cpe":"cpe:2.3:a:faye_project:faye:*:*:*:*:*:node.js:*:*","range":[{"introduced":"1.2.0"},{"fixed":"1.2.5"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:faye_project:faye:*:*:*:*:*:ruby:*:*","range":[{"introduced":"1.2.0"},{"fixed":"1.2.5"}]},{"range":[{"fixed":"65d297d341b607f3cb0b5fa6021a625a991cc30e"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["1.1.2","1.2.4","1.2.3","1.2.2","1.2.1","1.2.0","1.1.1","1.1.0","1.0.3","1.0.2","1.0.1","1.0.0","0.8.9","0.8.6","0.8.5","0.8.4","0.8.2","0.8.1","0.8.0","0.7.0","0.6.4","0.6.3","0.6.2","0.6.1","0.6.0","0.5.4","0.5.3","0.5.2","0.5.1","0.5.0","0.3.3","0.3.2","0.3.1","0.3.0","0.2.2","0.2.1","0.2.0","0.1.1","0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-11020.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}