CVE-2025-27371

MediumCVSS 6.9/10Last modified Jun 17, 2026

Description

In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities in the audience values of JWTs sent to authorization servers. The affected RFCs may include RFC 7523, and also RFC 7521, RFC 7522, RFC 9101 (JAR), and RFC 9126 (PAR).

Metrics

CVSS 3.1 6.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N

Weakness enumeration

CWE-305

Affected software

VendorProductVersions
IETFRFC 75237523

References

Timeline

Published
Mar 3, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-273745.3An issue was discovered in the Secure Boot component in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850, 10CVE-2025-273775.3Altium Designer version 24.9.0 does not validate self-signed server certificates for cloud connections. An attacker capable of performing a CVE-2025-273789.8AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. WCVE-2025-273794.6A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitraryCVE-2025-27389.8A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been declared as critical. This vulnerability affects unkCVE-2025-273807.6HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitCVE-2025-273877.4OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure.CVE-2025-273888.3Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.CVE-2025-273895.1A flaw exists in the verification of application installation sources within ColorOS. Under specific conditions, this issue may cause the riCVE-2025-27399.8A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been rated as critical. This issue affects some unknown pCVE-2025-273916.5Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are loggeCVE-2025-273927.2A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitiz