CVE-2025-27370
First published: Mon Mar 03 2025(Updated: )
OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechanism is used, a malicious Authorization Server could trick a Client into writing attacker-controlled values into the audience, including token endpoints or issuer identifiers of other Authorization Servers. The malicious Authorization Server could then use these private key JWTs to impersonate the Client.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenID Connect | <=1.0 errata set 2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/OWASP/ASVS/issues/2678
- https://openid.net/notice-of-a-security-vulnerability/
- https://openid.net/wp-content/uploads/2025/01/OIDF-Responsible-Disclosure-Notice-on-Security-Vulnerability-for-private_key_jwt.pdf
- https://talks.secworkshop.events/osw2025/talk/R8D9BS/
- https://eprint.iacr.org/2025/629
Frequently Asked Questions
What is the severity of CVE-2025-27370?
CVE-2025-27370 is classified as a high severity vulnerability due to the potential for audience injection attacks.
How do I fix CVE-2025-27370?
To fix CVE-2025-27370, upgrade to a version of OpenID Connect Core that is beyond 1.0 errata set 2.
Who is affected by CVE-2025-27370?
CVE-2025-27370 affects all implementations of OpenID Connect Core version 1.0 errata set 2.
What is the impact of CVE-2025-27370?
The impact of CVE-2025-27370 includes the potential for attackers to manipulate authentication mechanisms to gain unauthorized access.
When was CVE-2025-27370 disclosed?
CVE-2025-27370 was disclosed in early 2025, detailing vulnerabilities related to the private_key_jwt authentication mechanism.
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/weakness
- agent/source
- agent/references
- agent/severity
- agent/tags
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- vendor/openid foundation
- canonical/openid connect