OAuth, OIDC, and JWT identity CVEs
Tokens that are not verified, audiences that are not pinned, and skip-lists that match a query string. OAuth and OIDC fail when the RP trusts the shape of a JWT more than the signature.
How this protocol fails
OIDC is the default for new apps, which means a JWT verifier bug is an MFA bypass with a modern logo. 2023-2026 repeats three mistakes: alg:none or a skipped signature (SharePoint, SimpleHelp, WordPress OAuth SSO, node-jws), audience or key-lookup confusion (private_key_jwt spec CVEs, Zitadel expired keys), and alternate-path skips (OAuth2-Proxy, Drupal). A valid-looking token is not a valid login. Session mix-ups in SDKs (Duende, Okta Java) are the same class under load.
What security people should do
- Reject alg:none. Resolve the key from a server-side JWKS map, then verify. Never let the token pick the HMAC secret.
- Pin aud to one exact authorization-server identifier. Separate client keys per environment and tenant.
- Match skip-auth and callback allow-lists on path only, never on the full URI with query string.
- Load-test identity SDKs so user A never receives user B's token. Prefer DPoP or mTLS so a mixed token is useless on the wrong client.
- Read the validate-a-JWT recipe before you ship another verifier.
CVEs in this category
Showing 16 of 16
- CVE-2026-48558criticalSimpleHelp accepts unsigned OIDC tokens, MFA bypassSimpleHelp · SimpleHelp · 2026-05-12 · Patched
SimpleHelp through 5.5.15 (and 6.0 pre-release) accepted OIDC ID tokens without signature verification, including alg:none. A forged token bypasses MFA. Patch is out and a public PoC exists.
- CVE-2026-18207highKeycloak client policy enforcement flawKeycloak · Red Hat · 2026-03-18 · Patched
A 2026 Keycloak client-policy enforcement bug. Client policies are how you ban implicit flow, require PKCE, or force FAPI. If they do not fire, the realm's written standard is optional.
- CVE-2025-65945mediumAuth0 node-jws HS256 verification bypass via secret lookupauth0/node-jws · Auth0 / Okta · 2025-12-04 · Patched
node-jws before 3.2.3 / 4.0.1 can accept an HS256 JWT when the caller looks up the secret from attacker-controlled input. Medium on paper, but it is a signature bypass in the library under Auth0 and a long tail of Node verifiers.
- CVE-2025-14778highKeycloak UMA policy privilege escalationKeycloak · Red Hat · 2025-12-03 · Patched
Keycloak's UMA policy engine checked only the first resource in a request (CWE-266). Additional resources skipped the check. A privilege escalation in user-managed access.
- CVE-2025-12466highDrupal Simple OAuth/OIDC auth bypass via an alternate pathDrupal Simple OAuth / OIDC · Drupal · 2025-10-15 · Patched
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVE-2025-9485criticalWordPress OAuth SSO plugin JWT bypass, admin takeoverOAuth SSO WordPress plugin · miniOrange / WordPress ecosystem · 2025-08-26 · Patched
The OAuth SSO WordPress plugin through 6.26.12 failed JWT signature verification. A forged token becomes an administrator. Patched in 6.26.13.
- CVE-2025-54576critical 9.1OAuth2-Proxy skip_auth_routes regex matches the full URIOAuth2-Proxy · OAuth2-Proxy · 2025-07-28 · Patched
OAuth2-Proxy's skip_auth_routes regex ran against the full URI, including query parameters. A crafted query string could skip authentication on a protected path. CVSS 9.1.
- CVE-2025-7365low 3.1Keycloak First Broker Login TOCTOU, account-merge takeoverKeycloak · Red Hat · 2025-07-08 · Patched
Keycloak's First Broker Login had a time-of-check/time-of-use gap. A phishing or race could merge an attacker's IdP account onto a victim. CVSS 3.1 on paper. The identity lesson is larger than the score.
- CVE-2025-49151criticalICS JWT auth bypass via hard-coded constantsICS product (CISA ICSA-25-175-07) · ICS vendor (see CISA advisory) · 2025-06-24 · Patched
An industrial-control product accepted JWTs built from hard-coded constants (CWE-547). Critical authentication bypass. CISA ICSA-25-175-07.
- CVE-2025-31123highZitadel JWT auth grant ignores key expirationZitadel · Zitadel · 2025-03-27 · Patched
Zitadel's JWT authorization grant did not check whether the client key had expired. A retired key kept working. Patched by the project.
- CVE-2025-27371highOAuth 2.0 private_key_jwt audience ambiguityOAuth 2.0 specification (JWT profile) · IETF / OpenID Foundation · 2025-03-01 · Spec-level fix
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted by another. Disclosed by the OpenID Foundation with CVE-2025-27370.
- CVE-2025-27370highOpenID private_key_jwt audience ambiguityOpenID Connect specification · OpenID Foundation · 2025-03-01 · Spec-level fix
The OpenID Connect twin of CVE-2025-27371. private_key_jwt audience is ambiguous at the spec layer, so a client assertion can be replayed across authorization servers.
- CVE-2025-21085highPingFederate 2025 advisoryPingFederate · Ping Identity · 2025-03-01 · Patched
A PingFederate CVE from 2025. NVD detail was thin at the time of this brief. Treat it as a PingFederate security update you should already have taken, and confirm the vendor advisory for the exact build.
- CVE-2025-26620highDuende OAuth token management mixes tokens across requestsDuende .NET OAuth token management · Duende Software · 2025-02-18 · Patched
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still someone else's access token.
- CVE-2023-6787highKeycloak session hijack via prompt=login re-authenticationKeycloak · Red Hat · 2024-04-17 · Patched
Starting a new authentication with prompt=login could hijack an existing Keycloak session. The re-auth step did not bind to the original user tightly enough. Patched in the April 2024 Keycloak train, assigned 2023.
- CVE-2023-29357critical 9.8CISA KEVExploitedSharePoint JWT alg:none, impersonate any userMicrosoft SharePoint Server · Microsoft · 2023-06-13 · Actively exploited
SharePoint's ReadTokenCore skipped signature checks when the JWT header said alg:none. An unauthenticated attacker became any user, including farm admin. CVSS 9.8. CISA KEV. Chained with CVE-2023-24955 for RCE.