OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechanism is used, a malicious Authorization Server could trick a

The primary impact of CVE-2025-27370 lies in the potential for identity theft and unauthorized access. An attacker controlling a malicious Authorization Server can craft private key JWTs containing attacker-controlled audience values. These values could include token endpoints or issuer identifiers of other Authorization Servers, effectively allowing the attacker to impersonate the Client. This could lead to the attacker gaining access to sensitive data or performing actions on behalf of the Client, potentially escalating to broader system compromise if the Client has elevated privileges. The blast radius extends to any systems relying on the vulnerable OpenID Connect Core implementation for authentication.

1. Réservé2025-02-23
2. Publiée2025-03-03
3. Modifiée2025-04-25
4. EPSS mis à jour2026-04-02

The recommended mitigation for CVE-2025-27370 is to upgrade to OpenID Connect Core version 1.0.1 or later, which addresses the vulnerability. If upgrading is not immediately feasible, consider implementing stricter validation of the audience claim within the Client application. This validation should ensure that the audience matches the expected values and prevent the acceptance of JWTs with unexpected or attacker-controlled audience values. Web Application Firewalls (WAFs) configured to inspect JWTs and validate audience claims can provide an additional layer of defense. Carefully review and audit the configuration of your Authorization Servers and Clients to identify and eliminate any potential vulnerabilities.