CVE-2025-27371
First published: Mon Mar 03 2025(Updated: )
In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities in the audience values of JWTs sent to authorization servers. The affected RFCs may include RFC 7523, and also RFC 7521, RFC 7522, RFC 9101 (JAR), and RFC 9126 (PAR).
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IETF RFC 7523 | ||
| IETF RFC 7521 | ||
| RFC 7522 | ||
| RFC 9101 | ||
| IETF RFC 9126 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/OWASP/ASVS/issues/2678
- https://openid.net/notice-of-a-security-vulnerability/
- https://openid.net/wp-content/uploads/2025/01/OIDF-Responsible-Disclosure-Notice-on-Security-Vulnerability-for-private_key_jwt.pdf
- https://talks.secworkshop.events/osw2025/talk/R8D9BS/
- https://eprint.iacr.org/2025/629
Frequently Asked Questions
What is the severity of CVE-2025-27371?
CVE-2025-27371 has been classified with a moderate severity level due to ambiguities in audience values of JWTs.
How do I fix CVE-2025-27371?
To fix CVE-2025-27371, ensure that the audience values of JWTs conform to clear and well-defined specifications outlined in the affected RFCs.
What software is affected by CVE-2025-27371?
CVE-2025-27371 affects implementations using certain IETF RFCs, specifically RFC 7523, RFC 7522, and RFC 9101.
What are the potential impacts of CVE-2025-27371?
The potential impacts of CVE-2025-27371 include unauthorized access due to improper audience validation in token handling.
Is there a workaround for CVE-2025-27371?
As of now, there are no official workarounds for CVE-2025-27371 other than adhering to the proper configurations as per the relevant RFC specifications.
- agent/first-publish-date
- agent/description
- agent/type
- agent/severity
- agent/author
- agent/event
- agent/source
- collector/nvd-api
- source/NVD
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- vendor/ietf
- canonical/ietf rfc 7523
- canonical/ietf rfc 7521
- canonical/rfc 7522
- canonical/rfc 9101
- canonical/ietf rfc 9126