Read the docs
TI-2026-29789 Aliases CVE-2026-41164GHSA-9hmg-827w-9rhj

nuts-node: JWT type confusion in v1 access token introspection allows VP replay as access token

Priority LOW 19CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint (/auth/v1/introspect_access_token) accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims. This allows a Verifiable Presentation (VP) JWT to be replayed as an access token and receive an active: true introspection response. This vulnerability is fixed in 6.2.3 and 5.4.31.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00076 0th percentileScored 2026-11-07
Fix Fixed nuts-node (nuts-foundation): 6.2.3, 5.4.31

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nuts-foundationnuts-node6.0.0-alpha.1 to before 6.2.3; before 5.4.316.2.3, 5.4.31Patch availableCNA
—github.com/nuts-foundation/nuts-node (Go)up to 1.1.0—No fix listedGHSA-9hmg-827w-9rhj
  • nuts-node Vendornuts-foundation Affected 6.0.0-alpha.1 to before 6.2.3; before 5.4.31 Fixed in 6.2.3, 5.4.31 Patch available CNA
  • github.com/nuts-foundation/nuts-node (Go) Vendor— Affected up to 1.1.0 Fixed in — No fix listed GHSA-9hmg-827w-9rhj

Remediation

  • Fix · CNA nuts-node (nuts-foundation) Fixed in 6.2.3, 5.4.31

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41164
  2. 2026-10-03 Alias added: GHSA-9hmg-827w-9rhj

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences