CVE-2025-27371
In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities in the audience values of JWTs sent to authorization servers. The affected RFCs may include RFC 7523, and also RFC 7521, RFC 7522, RFC 9101 (JAR), and RFC 9126 (PAR).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27371?
CVE-2025-27371 has been classified with a moderate severity level due to ambiguities in audience values of JWTs.
How do I fix CVE-2025-27371?
To fix CVE-2025-27371, ensure that the audience values of JWTs conform to clear and well-defined specifications outlined in the affected RFCs.
What software is affected by CVE-2025-27371?
CVE-2025-27371 affects implementations using certain IETF RFCs, specifically RFC 7523, RFC 7522, and RFC 9101.
What are the potential impacts of CVE-2025-27371?
The potential impacts of CVE-2025-27371 include unauthorized access due to improper audience validation in token handling.
Is there a workaround for CVE-2025-27371?
As of now, there are no official workarounds for CVE-2025-27371 other than adhering to the proper configurations as per the relevant RFC specifications.