Authentication bypass in IETF RFC 7523
Priority LOW 30CWE-305Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities in the audience values of JWTs sent to authorization servers. The affected RFCs may include RFC 7523, and also RFC 7521, RFC 7522, RFC 9101 (JAR), and RFC 9126 (PAR).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00347 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27371
- 2026-10-03 Alias added: GHSA-rh3q-7g79-rp3x
References
Other 5
- https://openid.net/wp-content/uploads/2025/01/OIDF-Responsible-Disclosure-Notice-on-Security-Vulnerability-for-private_key_jwt.pdf
- https://openid.net/notice-of-a-security-vulnerability/
- https://talks.secworkshop.events/osw2025/talk/R8D9BS/
- https://github.com/OWASP/ASVS/issues/2678
- https://eprint.iacr.org/2025/629
More IETF vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-13920 The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker… KEVCVSS 3.1HIGH 7.5
- TI-2004-02631 The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for… CVSS 3.1CRITICAL 9.8
- TI-2024-03351 RADIUS Protocol under RFC2865 is vulnerable to forgery attacks. CVSS 3.1CRITICAL 9.0
- TI-2020-08191 IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic CVSS 3.1MEDIUM 5.3
- TI-2016-08218 An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too… CVSS 3.0HIGH 8.6
Sources
- CVE-2025-27371 · CVE Program
- CVE-2025-27371 · NVD
- FIRST EPSS
- GHSA-rh3q-7g79-rp3x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences