CVE-2025-27371 | BDVDB-2026-269083 Detail
IETFRFC 7523
Description#
In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities in the audience values of JWTs sent to authorization servers. The affected RFCs may include RFC 7523, and also RFC 7521, RFC 7522, RFC 9101 (JAR), and RFC 9126 (PAR).
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-305 Authentication Bypass by Primary Weakness
References#
- https://openid.net/wp-content/uploads/2025/01/OIDF-Responsible-Disclosure-Notice-on-Security-Vulnerability-for-private_key_jwt.pdf
- https://openid.net/notice-of-a-security-vulnerability/
- https://talks.secworkshop.events/osw2025/talk/R8D9BS/
- https://github.com/OWASP/ASVS/issues/2678
- https://eprint.iacr.org/2025/629
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.