Start with Identity
Subscribe
Identity CVE · OAuth / OIDC / JWT

CVE-2025-27371OAuth 2.0 private_key_jwt audience ambiguity

high
Product: OAuth 2.0 specification (JWT profile)Vendor: IETF / OpenID FoundationDisclosed: 2025-03-01Status: Spec-level fixProtocol deep diveNVD ↗

What broke

The OpenID Foundation disclosed that the OAuth 2.0 JWT client-authentication profile (private_key_jwt) leaves the audience value underspecified. A client assertion minted for authorization server A can be accepted by authorization server B if both share a view of the client's key and neither pins aud tightly. CVE-2025-27371 is the OAuth-spec ID. CVE-2025-27370 is the OpenID twin.

There is no single vendor patch. The fix is in the spec text and in how implementations validate aud.

Why it matters

private_key_jwt is the "grown-up" client authentication. Banks, FAPI deployments, and high-assurance CIAM stacks use it specifically to avoid shared secrets. An audience mix-up turns that strength into a confused-deputy: a JWT meant for one environment or tenant is a valid login somewhere else.

What to do

  • Pin aud to the exact authorization-server identifier (issuer or token-endpoint URL) your implementation now documents. Reject arrays that include extra values.
  • Separate client keys per environment and per tenant. Shared keys make the spec ambiguity exploitable.
  • Track the OpenID Foundation and IETF errata. This is a spec-level CVE, so library defaults will lag.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.