CVE-2025-27370 | BDVDB-2026-269082 Detail
OpenIDOpenID Connect
Description#
OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechanism is used, a malicious Authorization Server could trick a Client into writing attacker-controlled values into the audience, including token endpoints or issuer identifiers of other Authorization Servers. The malicious Authorization Server could then use these private key JWTs to impersonate the Client.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-305 Authentication Bypass by Primary Weakness
References#
- https://openid.net/wp-content/uploads/2025/01/OIDF-Responsible-Disclosure-Notice-on-Security-Vulnerability-for-private_key_jwt.pdf
- https://openid.net/notice-of-a-security-vulnerability/
- https://talks.secworkshop.events/osw2025/talk/R8D9BS/
- https://github.com/OWASP/ASVS/issues/2678
- https://eprint.iacr.org/2025/629
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.