CVE-2025-27371: JWT Audience Ambiguity in OAuth 2.0

The core impact of CVE-2025-27371 stems from the ambiguity in how audience values are handled within JWTs used for OAuth 2.0 client authentication. An attacker could craft a JWT with a manipulated or ambiguous audience claim, potentially tricking the authorization server into believing the request is legitimate. This could lead to unauthorized access to protected resources, data breaches, and potentially even complete account takeover depending on the sensitivity of the resources being accessed. The potential blast radius is significant, as OAuth 2.0 is widely used for authentication and authorization across numerous applications and services. While no direct precedent is immediately apparent, the potential for authorization bypass shares similarities with vulnerabilities that exploit improper JWT validation.

1. Reserved2025-02-23
2. Published2025-03-03
3. Modified2025-04-25
4. EPSS updated2026-04-02

The primary mitigation for CVE-2025-27371 is to upgrade to version 7523.0.1 or later, which addresses the ambiguity in audience value handling. If upgrading is not immediately feasible, consider implementing stricter audience validation on the authorization server side. This involves explicitly defining and verifying the expected audience values for each client application. Web Application Firewalls (WAFs) can be configured to inspect JWTs and block requests with suspicious or invalid audience claims. Monitor logs for unusual JWT activity, particularly requests with unexpected audience values. After upgrading, confirm proper JWT validation by testing client authentication with valid and invalid audience claims.