CVE-2020-28042: Servicestack

Medium severity, CVSS 5.3. EPSS: 2.3% chance of exploitation in the next 30 days.

ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.

Affected products

• Servicestack Servicestack: before 5.9.2 (fixed in 5.9.2)

Published 2020-11-02. Last modified 2026-06-17.