« Volver al listado

CVE-2025-27370

Estado: AplazadaMedia (6.9)—

OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechanism is used, a malicious Authorization Server could trick a Client into writing attacker-controlled values into the audience, including token endpoints or issuer identifiers of other Authorization Servers. The malicious Authorization Server could then use these private key JWTs to impersonate the Client.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Openid — Openid Connect CoreAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-27370",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-27370",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-04T16:59:06.842747Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "OpenID",
          "product": "OpenID Connect",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.0 errata set 2"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-03-03T18:15:40.650",
  "references": [
    {
      "url": "https://eprint.iacr.org/2025/629",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/OWASP/ASVS/issues/2678",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://openid.net/notice-of-a-security-vulnerability/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://openid.net/wp-content/uploads/2025/01/OIDF-Responsible-Disclosure-Notice-on-Security-Vulnerability-for-private_key_jwt.pdf",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://talks.secworkshop.events/osw2025/talk/R8D9BS/",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-305"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechanism is used, a malicious Authorization Server could trick a Client into writing attacker-controlled values into the audience, including token endpoints or issuer identifiers of other Authorization Servers. The malicious Authorization Server could then use these private key JWTs to impersonate the Client."
    },
    {
      "lang": "es",
      "value": "OpenID Connect Core a través del conjunto de erratas 1.0 2 permite la inyección de audiencia en determinadas situaciones. Cuando se utiliza el mecanismo de autenticación private_key_jwt, un servidor de autorización malintencionado podría engañar a un cliente para que escriba valores controlados por el atacante en la audiencia, incluidos endpoints de token o identificadores de emisor de otros servidores de autorización. El servidor de autorización malintencionado podría entonces utilizar estos JWT de clave privada para hacerse pasar por el cliente."
    }
  ],
  "lastModified": "2026-06-17T09:03:28.727",
  "sourceIdentifier": "cve@mitre.org"
}