What is CVE-2025-27371?

CVE-2025-27371 is a medium-severity vulnerability in Ietf Rfc 7523, classified under Authentication Bypass by Primary Weakness. CVSS score: 6.9/10. Published 2025-03-03.

How severe is CVE-2025-27371?

Medium severity. CVSS v3 base score is 6.9 out of 10.

Is CVE-2025-27371 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Ietf Rfc 7523

CVE-2025-27371

In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities in the audience values of JWTs sent to authorization servers. The affected RFCs may include RFC 7523, and also RFC 7521, RFC 7522, RFC 9101 (JAR), and RFC 9126 (PAR).

EPSS: 0.003 (24.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N.

Affected products

Ietf Rfc 7523 — versions 7523

Weakness classification (CWE)

CWE-305 — Authentication Bypass by Primary Weakness

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

Frequently asked questions

What is CVE-2025-27371?: CVE-2025-27371 is a medium-severity vulnerability in Ietf Rfc 7523, classified under Authentication Bypass by Primary Weakness. CVSS score: 6.9/10. Published 2025-03-03.
How severe is CVE-2025-27371?: Medium severity. CVSS v3 base score is 6.9 out of 10.
Is CVE-2025-27371 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.