{
  "cveId": "CVE-2023-47090",
  "url": "https://patchblox.com/security/cve/CVE-2023-47090",
  "summary": "CVE-2023-47090 is fixed in nats-server on 1 platform, first by DEBIAN-CVE-2023-47090, released October 30, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "nats-server: NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass",
  "description": "NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.",
  "published": "2023-10-30T17:15:52Z",
  "severity": "medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
  "epss": 0.00825,
  "epssPercentile": 0.5764,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "nats-server",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.10.3-1",
      "fix": "DEBIAN-CVE-2023-47090",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-47090",
      "released": "2023-10-30T17:15:52Z"
    },
    {
      "platform": "linux",
      "product": "nats-server",
      "release": "Debian 14",
      "fixedVersion": "2.10.3-1",
      "fix": "DEBIAN-CVE-2023-47090",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-47090",
      "released": "2023-10-30T17:15:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}