CVE-2025-27371

In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0...

6.9 Medium

In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, there are ambiguities in the audience values of JWTs sent to authorization servers. The affected RFCs may include RFC 7523, and also RFC 7521, RFC 7522, RFC 9101 (JAR), and RFC 9126 (PAR).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: High
Availability: None

Exploit likelihood

0.35%Up 0.3 points since Mar 4, 2025

What each source reports

CVE List Score used 6.9

Record: CVE-2025-27371
CVSS 3.1: 6.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N
Weakness: CWE-305
Updated: 2026-11-02

EUVDEUVD-2025-5567 6.9

Record: EUVD-2025-5567
CVSS 3.1: 6.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rh3q-7g79-rp3x 6.9

In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0...

Record: GHSA-rh3q-7g79-rp3x
CVSS 3.1: 6.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N
Weakness: CWE-305, CWE-863
Updated: 2026-11-02

NVD 6.9

Record: CVE-2025-27371
CVSS 3.1: 6.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N
Weakness: CWE-305
Updated: 2026-11-02

Affected products

ietf rfc 7523

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-27371 is a medium vulnerability (CVSS 6.9) in Ietf Rfc 7523, published March 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. No source names a fixed version.