PT-2025-9532 · Ietf · Ietf Oauth 2.0

Dr. Ralf Küsters + 2 · Publicado 2025-03-03 · Atualizado 2025-03-07 · CVE-2025-27371

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions IETF OAuth 2.0 versions (affected versions not specified)

Description The issue arises from ambiguities in the audience values of JSON Web Tokens (JWTs) sent to authorization servers when using the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism. This ambiguity is present in certain IETF OAuth 2.0-related specifications.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Enumeração de Fraquezas

CWE-305

CWE-863

Identificadores relacionados

CVE-2025-27371

Produtos afetados

Ietf Oauth 2.0

Referências · 11

• https://github.com/OWASP/ASVS/issues/2678 · Nota
• https://t.me/cvedetector/19403 · Publicação no Telegram
• https://t.me/cvenotify/113875 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-27371 · Nota de Segurança
• https://openid.net/notice-of-a-security-vulnerability · Nota
• https://eprint.iacr.org/2025/629 · Nota
• https://openid.net/wp-content/uploads/2025/01/OIDF-Responsible-Disclosure-Notice-on-Security-Vulnerability-for-private_key_jwt.pdf · Nota
• https://t.me/cvenotify/113217 · Publicação no Telegram
• https://talks.secworkshop.events/osw2025/talk/R8D9BS · Nota
• https://osv.dev/vulnerability/CVE-2025-27371 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1897912358032515498 · Publicação no Twitter