Read the docs
TI-2023-18614 Aliases CVE-2023-36820GHSA-qw22-8w9r-864h

micronaut security has invalid IdTokenClaimsValidator logic on aud

Priority MEDIUM 62CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0053 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed micronaut-security (micronaut-projects): 3.11.1, 3.10.2, 3.9.6 +8io.micronaut.security:micronaut-security-oauth2 (Maven): 3.11.1, 3.10.2, 3.9.6 +8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
micronaut-projectsmicronaut-security3.11.0 to before 3.11.1; 3.10.0 to before 3.10.2; 3.9.0 to before 3.9.6; 3.8.0 to before 3.8.4; 3.7.0 to before 3.7.4; 3.6.0 to before 3.6.6; 3.5.0 to before 3.5.3; 3.4.0 to before 3.4.3; 3.3.0 to before 3.3.2; 3.2.0 to before 3.2.4; 3.1.0 to before 3.1.23.11.1, 3.10.2, 3.9.6, 3.8.4, 3.7.4, 3.6.6, 3.5.3, 3.4.3, 3.3.2, 3.2.4, 3.1.2Patch availableCNA
—io.micronaut.security:micronaut-security-oauth2 (Maven)3.11.0 to before 3.11.13.11.1Patch availableGHSA-qw22-8w9r-864h
—io.micronaut.security:micronaut-security-oauth2 (Maven)3.10.0 to before 3.10.23.10.2Patch availableGHSA-qw22-8w9r-864h
—io.micronaut.security:micronaut-security-oauth2 (Maven)3.9.0 to before 3.9.63.9.6Patch availableGHSA-qw22-8w9r-864h
—io.micronaut.security:micronaut-security-oauth2 (Maven)3.8.0 to before 3.8.43.8.4Patch availableGHSA-qw22-8w9r-864h
—io.micronaut.security:micronaut-security-oauth2 (Maven)3.7.0 to before 3.7.43.7.4Patch availableGHSA-qw22-8w9r-864h
—io.micronaut.security:micronaut-security-oauth2 (Maven)3.6.0 to before 3.6.63.6.6Patch availableGHSA-qw22-8w9r-864h
—io.micronaut.security:micronaut-security-oauth2 (Maven)3.5.0 to before 3.5.33.5.3Patch availableGHSA-qw22-8w9r-864h
—io.micronaut.security:micronaut-security-oauth2 (Maven)3.4.0 to before 3.4.33.4.3Patch availableGHSA-qw22-8w9r-864h
—io.micronaut.security:micronaut-security-oauth2 (Maven)3.3.0 to before 3.3.23.3.2Patch availableGHSA-qw22-8w9r-864h
—io.micronaut.security:micronaut-security-oauth2 (Maven)3.2.0 to before 3.2.43.2.4Patch availableGHSA-qw22-8w9r-864h
—io.micronaut.security:micronaut-security-oauth2 (Maven)3.1.0 to before 3.1.23.1.2Patch availableGHSA-qw22-8w9r-864h
  • micronaut-security Vendormicronaut-projects Affected 3.11.0 to before 3.11.1; 3.10.0 to before 3.10.2; 3.9.0 to before 3.9.6; 3.8.0 to before 3.8.4; 3.7.0 to before 3.7.4; 3.6.0 to before 3.6.6; 3.5.0 to before 3.5.3; 3.4.0 to before 3.4.3; 3.3.0 to before 3.3.2; 3.2.0 to before 3.2.4; 3.1.0 to before 3.1.2 Fixed in 3.11.1, 3.10.2, 3.9.6, 3.8.4, 3.7.4, 3.6.6, 3.5.3, 3.4.3, 3.3.2, 3.2.4, 3.1.2 Patch available CNA
  • io.micronaut.security:micronaut-security-oauth2 (Maven) Vendor— Affected 3.11.0 to before 3.11.1 Fixed in 3.11.1 Patch available GHSA-qw22-8w9r-864h
  • io.micronaut.security:micronaut-security-oauth2 (Maven) Vendor— Affected 3.10.0 to before 3.10.2 Fixed in 3.10.2 Patch available GHSA-qw22-8w9r-864h
  • io.micronaut.security:micronaut-security-oauth2 (Maven) Vendor— Affected 3.9.0 to before 3.9.6 Fixed in 3.9.6 Patch available GHSA-qw22-8w9r-864h
  • io.micronaut.security:micronaut-security-oauth2 (Maven) Vendor— Affected 3.8.0 to before 3.8.4 Fixed in 3.8.4 Patch available GHSA-qw22-8w9r-864h
  • io.micronaut.security:micronaut-security-oauth2 (Maven) Vendor— Affected 3.7.0 to before 3.7.4 Fixed in 3.7.4 Patch available GHSA-qw22-8w9r-864h
  • io.micronaut.security:micronaut-security-oauth2 (Maven) Vendor— Affected 3.6.0 to before 3.6.6 Fixed in 3.6.6 Patch available GHSA-qw22-8w9r-864h
  • io.micronaut.security:micronaut-security-oauth2 (Maven) Vendor— Affected 3.5.0 to before 3.5.3 Fixed in 3.5.3 Patch available GHSA-qw22-8w9r-864h
  • io.micronaut.security:micronaut-security-oauth2 (Maven) Vendor— Affected 3.4.0 to before 3.4.3 Fixed in 3.4.3 Patch available GHSA-qw22-8w9r-864h
  • io.micronaut.security:micronaut-security-oauth2 (Maven) Vendor— Affected 3.3.0 to before 3.3.2 Fixed in 3.3.2 Patch available GHSA-qw22-8w9r-864h
  • io.micronaut.security:micronaut-security-oauth2 (Maven) Vendor— Affected 3.2.0 to before 3.2.4 Fixed in 3.2.4 Patch available GHSA-qw22-8w9r-864h
  • io.micronaut.security:micronaut-security-oauth2 (Maven) Vendor— Affected 3.1.0 to before 3.1.2 Fixed in 3.1.2 Patch available GHSA-qw22-8w9r-864h

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:objectcomputing:micronaut_security:*:*:*:*:*:*:*:*before 3.1.2; 3.2.0 to before 3.2.4; 3.3.0 to before 3.3.2; 3.4.0 to before 3.4.3; 3.5.0 to before 3.5.3; 3.6.0 to before 3.6.6; 3.7.0 to before 3.7.4; 3.8.0 to before 3.8.4; 3.9.0 to before 3.9.6; 3.10.0 to before 3.10.2Vulnerablemicronaut-projects
cpe:2.3:a:objectcomputing:micronaut_security:3.11.0:*:*:*:*:*:*:*3.11.0Vulnerablemicronaut-projects
  • cpe:2.3:a:objectcomputing:micronaut_security:*:*:*:*:*:*:*:* Versions before 3.1.2; 3.2.0 to before 3.2.4; 3.3.0 to before 3.3.2; 3.4.0 to before 3.4.3; 3.5.0 to before 3.5.3; 3.6.0 to before 3.6.6; 3.7.0 to before 3.7.4; 3.8.0 to before 3.8.4; 3.9.0 to before 3.9.6; 3.10.0 to before 3.10.2 Vulnerable ·micronaut-projects
  • cpe:2.3:a:objectcomputing:micronaut_security:3.11.0:*:*:*:*:*:*:* Versions 3.11.0 Vulnerable ·micronaut-projects

Remediation

  • Fix · CNA micronaut-security (micronaut-projects) Fixed in 3.11.1, 3.10.2, 3.9.6, 3.8.4, 3.7.4, 3.6.6, 3.5.3, 3.4.3, 3.3.2, 3.2.4, 3.1.2
  • Fix · GHSA-qw22-8w9r-864h io.micronaut.security:micronaut-security-oauth2 (Maven) Fixed in 3.11.1 Advisory →
  • Fix · GHSA-qw22-8w9r-864h io.micronaut.security:micronaut-security-oauth2 (Maven) Fixed in 3.10.2 Advisory →
  • Fix · GHSA-qw22-8w9r-864h io.micronaut.security:micronaut-security-oauth2 (Maven) Fixed in 3.9.6 Advisory →
  • Fix · GHSA-qw22-8w9r-864h io.micronaut.security:micronaut-security-oauth2 (Maven) Fixed in 3.8.4 Advisory →
  • Fix · GHSA-qw22-8w9r-864h io.micronaut.security:micronaut-security-oauth2 (Maven) Fixed in 3.7.4 Advisory →
  • Fix · GHSA-qw22-8w9r-864h io.micronaut.security:micronaut-security-oauth2 (Maven) Fixed in 3.6.6 Advisory →
  • Fix · GHSA-qw22-8w9r-864h io.micronaut.security:micronaut-security-oauth2 (Maven) Fixed in 3.5.3 Advisory →
  • Fix · GHSA-qw22-8w9r-864h io.micronaut.security:micronaut-security-oauth2 (Maven) Fixed in 3.4.3 Advisory →
  • Fix · GHSA-qw22-8w9r-864h io.micronaut.security:micronaut-security-oauth2 (Maven) Fixed in 3.3.2 Advisory →
  • Fix · GHSA-qw22-8w9r-864h io.micronaut.security:micronaut-security-oauth2 (Maven) Fixed in 3.2.4 Advisory →
  • Fix · GHSA-qw22-8w9r-864h io.micronaut.security:micronaut-security-oauth2 (Maven) Fixed in 3.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-36820
  2. 2026-10-03 Alias added: GHSA-qw22-8w9r-864h

References

Exploit 1

Patch 1

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences