OAuth, OIDC, and JWT identity CVEs
Tokens that are not verified, audiences that are not pinned, and skip-lists that match a query string. OAuth and OIDC fail when the RP trusts the shape of a JWT more than the signature.
How this protocol fails
OIDC is the default for new apps, which means a JWT verifier bug is an MFA bypass with a modern logo. 2023-2026 repeats three mistakes: alg:none or a skipped signature (SharePoint, SimpleHelp, WordPress OAuth SSO, node-jws), audience or key-lookup confusion (private_key_jwt spec CVEs, Zitadel expired keys), and alternate-path skips (OAuth2-Proxy, Drupal). A valid-looking token is not a valid login. Session mix-ups in SDKs (Duende, Okta Java) are the same class under load.
What security people should do
- Reject alg:none. Resolve the key from a server-side JWKS map, then verify. Never let the token pick the HMAC secret.
- Pin aud to one exact authorization-server identifier. Separate client keys per environment and tenant.
- Match skip-auth and callback allow-lists on path only, never on the full URI with query string.
- Load-test identity SDKs so user A never receives user B's token. Prefer DPoP or mTLS so a mixed token is useless on the wrong client.
- Read the validate-a-JWT recipe before you ship another verifier.
CVEs in this category
Showing 21 of 21
- CVE-2026-89111critical 10.0SAP Cloud SDK for Python sends OAuth2 client secrets to an attacker-chosen hostSAP Cloud SDK for Python (sap-cloud-sdk) · SAP · 2026-10-13 · Patched
CVE-2026-89111 lets anyone who controls the tenant subdomain in a multi-tenant SAP BTP application redirect the SDK's OAuth2 token request, along with the app's client ID and secret. CVSS 10.0, fixed in sap-cloud-sdk 0.45.2.
- CVE-2026-94127critical 9.8CISA KEVExploitedF5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-dayF5 BIG-IP Access Policy Manager (APM) · F5 · 2026-09-22 · Actively exploited
BIG-IP APM configured as an OAuth authorization server had a heap overflow that unauthenticated traffic could turn into remote code execution. CVSS 9.8, exploited, CISA KEV on September 22, 2026.
- CVE-2026-55040critical 9.1CISA KEVExploitedSharePoint JWT validation chain, forge a token and become any userMicrosoft SharePoint Server · Microsoft · 2026-07-14 · Actively exploited
Four weaknesses across two SharePoint JWT token handlers chain into an unauthenticated authentication bypass. Rapid7 published a proof of concept in August 2026 and exploitation followed within days. CVSS 9.1, patched in July 2026.
- CVE-2026-59822high 8.2CISA KEVExploitedLiteLLM MCP gateway accepts any Bearer token after key validation failsLiteLLM · BerriAI · 2026-06-30 · Actively exploited
LiteLLM's MCP Streamable HTTP endpoint fell back to an empty auth object when key validation failed, so a fabricated Authorization header reached the gateway's MCP tools. Honeypots saw single-character tokens used in the wild. CISA KEV on September 2, 2026.
- CVE-2026-48558critical 9.5CISA KEVExploitedSimpleHelp accepts unsigned OIDC tokens, MFA bypassSimpleHelp · SimpleHelp · 2026-05-12 · Actively exploited
SimpleHelp through 5.5.15 (and 6.0 pre-release) accepted OIDC ID tokens without signature verification, including alg:none. A forged token bypasses MFA. Patch is out and a public PoC exists.
- CVE-2026-5430critical 10.0CISA KEVExploitedWSO2 API Manager accepts JWTs signed with unconfigured algorithmsWSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway · WSO2 · 2026-05-03 · Actively exploited
WSO2 API Manager and related gateways validated JWTs signed with algorithms they were never configured to accept, allowing account takeover including admins. CVSS 10.0, advisory May 2026, CISA KEV September 24, 2026.
- CVE-2026-18207high 6.5Keycloak client policy enforcement flawKeycloak · Red Hat · 2026-03-18 · Patched
A 2026 Keycloak client-policy enforcement bug. Client policies are how you ban implicit flow, require PKCE, or force FAPI. If they do not fire, the realm's written standard is optional.
- CVE-2025-65945high 7.5Auth0 node-jws HS256 verification bypass via secret lookupauth0/node-jws · Auth0 / Okta · 2025-12-04 · Patched
node-jws before 3.2.3 / 4.0.1 can accept an HS256 JWT when the caller looks up the secret from attacker-controlled input. Medium on paper, but it is a signature bypass in the library under Auth0 and a long tail of Node verifiers.
- CVE-2025-14778high 5.4Keycloak UMA policy privilege escalationKeycloak · Red Hat · 2025-12-03 · Patched
Keycloak's UMA policy engine checked only the first resource in a request (CWE-266). Additional resources skipped the check. A privilege escalation in user-managed access.
- CVE-2025-12466high 7.5Drupal Simple OAuth/OIDC auth bypass via an alternate pathDrupal Simple OAuth / OIDC · Drupal · 2025-10-15 · Patched
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVE-2025-9485critical 9.8WordPress OAuth SSO plugin JWT bypass, admin takeoverOAuth SSO WordPress plugin · miniOrange / WordPress ecosystem · 2025-08-26 · Patched
The OAuth SSO WordPress plugin through 6.26.12 failed JWT signature verification. A forged token becomes an administrator. Patched in 6.26.13.
- CVE-2025-54576critical 9.1OAuth2-Proxy skip_auth_routes regex matches the full URIOAuth2-Proxy · OAuth2-Proxy · 2025-07-28 · Patched
OAuth2-Proxy's skip_auth_routes regex ran against the full URI, including query parameters. A crafted query string could skip authentication on a protected path. CVSS 9.1.
- CVE-2025-7365low 3.1Keycloak First Broker Login TOCTOU, account-merge takeoverKeycloak · Red Hat · 2025-07-08 · Patched
Keycloak's First Broker Login had a time-of-check/time-of-use gap. A phishing or race could merge an attacker's IdP account onto a victim. CVSS 3.1 on paper. The identity lesson is larger than the score.
- CVE-2025-49151critical 9.3ICS JWT auth bypass via hard-coded constantsICS product (CISA ICSA-25-175-07) · ICS vendor (see CISA advisory) · 2025-06-24 · Patched
An industrial-control product accepted JWTs built from hard-coded constants (CWE-547). Critical authentication bypass. CISA ICSA-25-175-07.
- CVE-2025-31123high 8.7Zitadel JWT auth grant ignores key expirationZitadel · Zitadel · 2025-03-27 · Patched
Zitadel's JWT authorization grant did not check whether the client key had expired. A retired key kept working. Patched by the project.
- CVE-2025-27371high 6.9OAuth 2.0 private_key_jwt audience ambiguityOAuth 2.0 specification (JWT profile) · IETF / OpenID Foundation · 2025-03-01 · Spec-level fix
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted by another. Disclosed by the OpenID Foundation with CVE-2025-27370.
- CVE-2025-27370high 6.9OpenID private_key_jwt audience ambiguityOpenID Connect specification · OpenID Foundation · 2025-03-01 · Spec-level fix
The OpenID Connect twin of CVE-2025-27371. private_key_jwt audience is ambiguous at the spec layer, so a client assertion can be replayed across authorization servers.
- CVE-2025-21085high 2.1PingFederate 2025 advisoryPingFederate · Ping Identity · 2025-03-01 · Patched
A PingFederate CVE from 2025. NVD detail was thin at the time of this brief. Treat it as a PingFederate security update you should already have taken, and confirm the vendor advisory for the exact build.
- CVE-2025-26620high 6.3Duende OAuth token management mixes tokens across requestsDuende .NET OAuth token management · Duende Software · 2025-02-18 · Patched
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still someone else's access token.
- CVE-2023-6787high 8.8Keycloak session hijack via prompt=login re-authenticationKeycloak · Red Hat · 2024-04-17 · Patched
Starting a new authentication with prompt=login could hijack an existing Keycloak session. The re-auth step did not bind to the original user tightly enough. Patched in the April 2024 Keycloak train, assigned 2023.
- CVE-2023-29357critical 9.8CISA KEVExploitedSharePoint JWT alg:none, impersonate any userMicrosoft SharePoint Server · Microsoft · 2023-06-13 · Actively exploited
SharePoint's ReadTokenCore skipped signature checks when the JWT header said alg:none. An unauthenticated attacker became any user, including farm admin. CVSS 9.8. CISA KEV. Chained with CVE-2023-24955 for RCE.