PT-2025-9532 · Ietf · Ietf Oauth 2.0

Dr. Ralf Küsters + 2 · Published 2025-03-03 · Updated 2025-03-07 · CVE-2025-27371

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions IETF OAuth 2.0 versions (affected versions not specified)

Description The issue arises from ambiguities in the audience values of JSON Web Tokens (JWTs) sent to authorization servers when using the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism. This ambiguity is present in certain IETF OAuth 2.0-related specifications.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-305

CWE-863

Related Identifiers

CVE-2025-27371

Affected Products

Ietf Oauth 2.0

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-27371 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27371 · Vendor Advisory
• https://github.com/OWASP/ASVS/issues/2678 · Note
• https://t.me/cvedetector/19403 · Telegram Post
• https://t.me/cvenotify/113875 · Telegram Post
• https://openid.net/notice-of-a-security-vulnerability · Note
• https://eprint.iacr.org/2025/629 · Note
• https://openid.net/wp-content/uploads/2025/01/OIDF-Responsible-Disclosure-Notice-on-Security-Vulnerability-for-private_key_jwt.pdf · Note
• https://t.me/cvenotify/113217 · Telegram Post
• https://talks.secworkshop.events/osw2025/talk/R8D9BS · Note
• https://twitter.com/CVEnew/status/1897912358032515498 · Twitter Post