CVE-2025-27371
No sign of exploitation. No public exploitation artifact known so far.
When using JSON Web Tokens (JWTs) for OAuth 2.0 client authentication, there are unclear rules about which audience values should be accepted by authorization servers. This ambiguity could allow attackers to craft tokens that bypass intended security checks.
CWE-305 (Missing Cryptographic Step) stems from ambiguous audience claim validation in JWT-based OAuth 2.0 client authentication flows across multiple RFCs (7523, 7521, 7522, 9101, 9126). An attacker can exploit inconsistent audience validation logic to present JWTs with crafted audience values that different implementations may accept differently, potentially leading to unauthorized token issuance or authentication bypass.