CVEs-PoC/2021/CVE-2021-27306.md

### [CVE-2021-27306](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27306)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)

### Description

An improper access control vulnerability in the JWT plugin in Kong Gateway prior to 2.3.2.0 allows unauthenticated users access to authenticated routes without a valid token JWT.

### POC

#### Reference
- https://medium.com/@sew.campos/cve-2021-27306-access-an-authenticated-route-on-kong-api-gateway-6ae3d81968a3

#### Github
- https://github.com/starnightcyber/vul-info-collect