← Back to CVEs
CVE-2025-27370
MEDIUM6.9
Description
OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechanism is used, a malicious Authorization Server could trick a Client into writing attacker-controlled values into the audience, including token endpoints or issuer identifiers of other Authorization Servers. The malicious Authorization Server could then use these private key JWTs to impersonate the Client.
CVE Details
CVSS v3.1 Score6.9
SeverityMEDIUM
CVSS VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N
Attack VectorNETWORK
ComplexityHIGH
Privileges RequiredNONE
User InteractionREQUIRED
Published3/3/2025
Last Modified4/25/2025
Sourcenvd
Honeypot Sightings0
Weaknesses (CWE)
CWE-305
References
https://eprint.iacr.org/2025/629(cve@mitre.org)
https://github.com/OWASP/ASVS/issues/2678(cve@mitre.org)
https://openid.net/notice-of-a-security-vulnerability/(cve@mitre.org)
https://openid.net/wp-content/uploads/2025/01/OIDF-Responsible-Disclosure-Notice-on-Security-Vulnerability-for-private_key_jwt.pdf(cve@mitre.org)
https://talks.secworkshop.events/osw2025/talk/R8D9BS/(cve@mitre.org)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.