CVE-2020-26172 in Business Workflow
Summary
by MITRE • 12/18/2020
Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The JWT token does not contain an expiration timestamp.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/22/2026
This vulnerability in tangro Business Workflow affects versions prior to 1.18.1 and represents a critical authentication flaw that undermines the security of the entire system. The core issue stems from the application's improper implementation of JSON Web Token generation where every user login produces identical tokens regardless of the user identity or session context. This fundamental design flaw creates a scenario where an attacker who intercepts a valid JWT token during one authentication event can reuse that same token to impersonate any user within the active session window. The vulnerability directly violates security best practices and represents a severe weakness in the application's authentication mechanism.
The technical implementation flaw manifests as a lack of session-specific token generation and the absence of time-based expiration mechanisms within the JWT tokens. Without proper token uniqueness and expiration timestamps, the system fails to maintain proper session isolation and temporal security controls. This vulnerability enables unauthorized access through token reuse attacks and represents a classic case of inadequate session management. The absence of expiration timestamps means tokens remain valid indefinitely until manually invalidated, creating an extended window of opportunity for attackers to exploit the system.
The operational impact of this vulnerability is substantial and multifaceted. An attacker with access to a single valid JWT token can potentially access the application as any user within the active session period, leading to unauthorized data access, modification, or deletion. This creates a significant risk of data breaches and privilege escalation attacks. The vulnerability also undermines the principle of least privilege and proper access control enforcement, as the system cannot distinguish between legitimate and malicious token usage. Organizations using affected versions face increased risk of insider threats and external attacks, particularly when tokens are transmitted over unencrypted channels or stored in insecure locations.
Security mitigations for this vulnerability should include immediate implementation of version 1.18.1 or later where the JWT token generation has been properly fixed to include unique session identifiers and proper expiration timestamps. The system should implement time-based token expiration with reasonable intervals and ensure that each login generates a unique token. Additionally, organizations should enforce secure transmission of tokens using HTTPS, implement proper token storage mechanisms, and consider adding token revocation capabilities. This vulnerability aligns with CWE-305 authentication weaknesses and maps to attack techniques in the MITRE ATT&CK framework under credential access and privilege escalation categories, specifically targeting the use of stolen credentials and session management flaws that enable persistent unauthorized access to systems and applications.