CVE-2025-27371CWE-305

In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities…

Medium · published March 3, 2025

CVSS v3.1
6.9
EPSS
0%
Percentile
27.1
In the wild
Unconfirmed
What it is

In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities in the audience values of JWTs sent to authorization servers. The affected RFCs may include RFC 7523, and also RFC 7521, RFC 7522, RFC 9101 (JAR), and RFC 9126 (PAR).

The record
Technical detail
CVSS v3.1
6.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00347 · 27.1th percentile
Weakness
CWE-305 · Authentication Bypass by Primary Weakness
Published
2025-03-03T00:00Z
EPSS history
Timeline
  • 03 MAR 00:00Z
    In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities…
    cvelistv5