Unrated
Security advisory
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-47090
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 13:38 UTC · Revision 1
Source evidence
NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.
osv:CVE-2023-47090
Complete source record
{
"id": "1f822fb250bf75c7d4e794c70b3c09e540b88b4feb7c4f07af9fa8dc6217a678",
"url": "https://osv.dev/vulnerability/CVE-2023-47090",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2023-47090",
"summary": "NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.",
"evidence": "osv:CVE-2023-47090",
"products": [],
"severity": "unknown",
"structured": {
"id": "CVE-2023-47090",
"aliases": [
"CVE-2023-47090",
"GHSA-fr2g-9hjm-wr23",
"GO-2023-2133"
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nats-io/nats-server",
"type": "GIT",
"events": [
{
"introduced": "0e3c7230e4b7c85795592f74a62351f6fe22fcbd"
},
{
"fixed": "45436e1e5021106cebc9d76e6af0779c908b0f7a"
},
{
"introduced": "77e198333fb2b25029b620fae3574b328de37f89"
},
{
"fixed": "203c4b9c2d952e9bf05e1e5e825f55c3201a6128"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.9.23"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:linuxfoundation:nats-server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.10.0"
},
{
"fixed": "2.10.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v2.10.1",
"v2.10.0",
"v2.9.22",
"v2.9.21",
"v2.9.20",
"v2.9.19",
"v2.9.18",
"v2.9.17",
"v2.9.16",
"v2.9.15",
"v2.9.14",
"v2.9.12",
"v2.9.11",
"v2.9.10",
"v2.9.9",
"v2.9.8",
"v2.9.7",
"v2.9.6",
"v2.9.5",
"v2.9.4",
"v2.9.3",
"v2.9.2",
"v2.9.1",
"v2.9.0",
"v2.8.4",
"v2.8.3",
"v2.8.2",
"v2.8.1",
"v2.8.0",
"v2.7.4",
"v2.7.3",
"v2.7.2",
"v2.7.1",
"v2.7.0",
"v2.7.0-rc2",
"v2.7.0-rc1",
"v2.6.6",
"v2.6.5",
"v2.6.4",
"v2.6.3",
"v2.6.2",
"v2.6.1",
"v2.6.0",
"v2.5.0",
"v2.4.0",
"v2.3.4",
"v2.3.3",
"v2.3.2",
"v2.3.1",
"v2.3.0",
"v2.2.6",
"v2.2.5",
"v2.2.4",
"v2.2.3",
"v2.2.2",
"v2.2.1",
"v2.2.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-47090.json"
}
}
],
"modified": "2026-10-28T02:30:36.170750618Z",
"provider": "osv",
"references": [
"https://www.openwall.com/lists/oss-security/2023/10/13/2",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47090.json",
"https://github.com/nats-io/nats-server/security/advisories/GHSA-fr2g-9hjm-wr23",
"https://nvd.nist.gov/vuln/detail/CVE-2023-47090"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47090.json"
}
},
"related_cves": [
{
"value": "CVE-2023-47090",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 503207,
"published_at": "2023-10-30T00:00:00+00:00"
}