title: JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access
description: HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.
problem types: CWE-285 Improper Authorization
affected:
{
vendor: HashiCorp
product: Consul
platforms: [64 bit, 32 bit, x86, ARM, MacOS, Windows, Linux]
repo: https://github.com/hashicorp/consul
versions:
status: affected, version: 1.16.0
defaultStatus: unaffected
}
{
vendor: HashiCorp
product: Consul Enterprise
platforms: [64 bit, 32 bit, x86, ARM, MacOS, Windows, Linux]
versions:
status: affected, version: 1.16.0
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
]