Start with Identity
Subscribe
Identity CVE · OAuth / OIDC / JWT

CVE-2025-27370OpenID private_key_jwt audience ambiguity

high
Product: OpenID Connect specificationVendor: OpenID FoundationDisclosed: 2025-03-01Status: Spec-level fixProtocol deep diveNVD ↗

What broke

CVE-2025-27370 is the OpenID Connect identifier for the same private_key_jwt audience ambiguity as CVE-2025-27371. A client assertion is a JWT. If aud is not a single, exact identifier for the intended authorization server, another server that knows the client's public key may accept it.

Why it matters

OIDC deployments reuse OAuth client authentication. Multi-tenant SaaS IdPs and multi-region banks are the obvious victims: one environment's client JWT becomes another's. This is a protocol footgun, not a single product bug.

What to do

  • Same control as 27371: exact aud, per-environment keys, and a library that rejects surprising audiences.
  • Review FAPI deployments first. They lean on private_key_jwt and sender-constrained tokens.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.