{"id":"CVE-2023-36820","aliases":["EUVD-2023-2796","GHSA-qw22-8w9r-864h"],"status":"published","title":"micronaut security has invalid IdTokenClaimsValidator logic on aud","description":"Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0053,"percentile":0.45291,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2023-10-05T20:55:14Z","modified":"2026-10-28T10:35:17Z","fixes":[{"ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","fixed_in":["3.11.1","3.10.2","3.9.6","3.8.4","3.7.4","3.6.6","3.5.3","3.4.3","3.3.2","3.2.4","3.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.0"},{"fixed":"3.11.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10.0"},{"fixed":"3.10.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0"},{"fixed":"3.9.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.0"},{"fixed":"3.8.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0"},{"fixed":"3.7.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.0"},{"fixed":"3.11.1"}]}],"versions":["3.11.0"]},{"source":"osv","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10.0"},{"fixed":"3.10.2"}]}],"versions":["3.10.0","3.10.1"]},{"source":"osv","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0"},{"fixed":"3.9.6"}]}],"versions":["3.9.0","3.9.1","3.9.2","3.9.3","3.9.4","3.9.5"]},{"source":"osv","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.0"},{"fixed":"3.8.4"}]}],"versions":["3.8.0","3.8.1","3.8.2","3.8.3"]},{"source":"osv","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.0"},{"fixed":"3.7.4"}]}],"versions":["3.7.0","3.7.1","3.7.2","3.7.3"]},{"source":"osv","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.6"}]}],"versions":["3.6.0","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5"]},{"source":"osv","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.3"}]}],"versions":["3.5.0","3.5.1","3.5.2"]},{"source":"osv","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.3"}]}],"versions":["3.4.0","3.4.1","3.4.2"]},{"source":"osv","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.2"}]}],"versions":["3.3.0","3.3.1"]},{"source":"osv","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.4"}]}],"versions":["3.2.0","3.2.1","3.2.2","3.2.3"]},{"source":"osv","ecosystem":"Maven","package":"io.micronaut.security:micronaut-security-oauth2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.2"}]}],"versions":["3.1.0","3.1.1"]}],"products":[{"vendor":"micronaut-projects","product":"micronaut-security"},{"vendor":"objectcomputing","product":"micronaut_security"}],"references":[{"url":"https://github.com/micronaut-projects/micronaut-security/security/advisories/GHSA-qw22-8w9r-864h","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Mitigation","Third Party Advisory","advisory","web"]},{"url":"https://github.com/micronaut-projects/micronaut-security/commit/9728b925221a0d87798ccf250657a3c214b7e980","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/micronaut-projects/micronaut-security/blob/master/security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java#L202","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36820","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qw22-8w9r-864h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36820.json","tags":["advisory"]},{"url":"https://github.com/micronaut-projects/micronaut-security","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-36820","title":"micronaut security has invalid IdTokenClaimsValidator logic on aud","description":"Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.\n","status":"published","published":"2023-10-09T13:30:26.387Z","modified":"2024-09-19T14:39:04.617Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:35:28.218693Z"}],"euvd":[{"id":"EUVD-2023-2796","description":"Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.\n","status":"published","published":"2023-10-09T13:30:26Z","modified":"2024-09-19T14:39:04Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:19.06347Z"}],"ghsa":[{"id":"GHSA-qw22-8w9r-864h","title":"io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud","description":"### Summary\n\nIdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider.\n\n### Details\n\nSee https://github.com/micronaut-projects/micronaut-security/blob/master/security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java#L202\n\nThis logic violates point 3 of https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation. \n\nWorkaround exists by setting `micronaut.security.token.jwt.claims-validators.audience` with valid values. \n `micronaut.security.token.jwt.claims-validators.openid-idtoken` can be kept as default on.\n\n### PoC\n\nShould probably be:\n\n```java\n                return issuer.equalsIgnoreCase(iss) \u0026\u0026\n                        audiences.contains(clientId) \u0026\u0026\n                                validateAzp(claims, clientId, audiences);\n```\n\n### Impact\n\nAny OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared.\n\n\n### Mitigation\n\nPlease upgrade to a patched `micronaut-security-oauth2` release as soon as possible.  \n\nIf you cannot upgrade, for example, if you are still using Micronaut Framework 2, you can patch your application by creating a replacement of `IdTokenClaimsValidatorReplacement`\n\n```java\npackage cve;\n\nimport io.micronaut.context.annotation.Replaces;\nimport io.micronaut.context.annotation.Requires;\nimport io.micronaut.core.annotation.NonNull;\nimport io.micronaut.core.util.StringUtils;\nimport io.micronaut.security.config.SecurityConfigurationProperties;\nimport io.micronaut.security.oauth2.client.IdTokenClaimsValidator;\nimport io.micronaut.security.oauth2.configuration.OauthClientConfiguration;\nimport io.micronaut.security.oauth2.configuration.OpenIdClientConfiguration;\nimport io.micronaut.security.token.jwt.generator.claims.JwtClaims;\nimport io.micronaut.security.token.jwt.validator.JwtClaimsValidatorConfigurationProperties;\n\nimport javax.inject.Singleton;\nimport java.net.URL;\nimport java.util.Collection;\nimport java.util.List;\nimport java.util.Optional;\n\n@Requires(property = SecurityConfigurationProperties.PREFIX + \".authentication\", value = \"idtoken\")\n@Requires(property = JwtClaimsValidatorConfigurationProperties.PREFIX + \".openid-idtoken\", notEquals = StringUtils.FALSE)\n@Singleton\n@Replaces(IdTokenClaimsValidator.class)\npublic class IdTokenClaimsValidatorReplacement extends IdTokenClaimsValidator {\n    public IdTokenClaimsValidatorReplacement(Collection\u003cOauthClientConfiguration\u003e oauthClientConfigurations) {\n        super(oauthClientConfigurations);\n    }\n\n    @Override\n    protected boolean validateIssuerAudienceAndAzp(@NonNull JwtClaims claims,\n                                                   @NonNull String iss,\n                                                   @NonNull List\u003cString\u003e audiences,\n                                                   @NonNull String clientId,\n                                                   @NonNull OpenIdClientConfiguration openIdClientConfiguration) {\n        if (openIdClientConfiguration.getIssuer().isPresent()) {\n            Optional\u003cURL\u003e issuerOptional = openIdClientConfiguration.getIssuer();\n            if (issuerOptional.isPresent()) {\n                String issuer = issuerOptional.get().toString();\n                return issuer.equalsIgnoreCase(iss) \u0026\u0026\n                        audiences.contains(clientId) \u0026\u0026\n                                validateAzp(claims, clientId, audiences);\n            }\n        }\n        return false;\n    }\n}\n``","status":"published","published":"2023-10-05T20:55:14Z","modified":"2023-11-08T05:04:41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:37:16.721714Z"}],"nvd":[{"id":"CVE-2023-36820","description":"Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.\n","status":"published","published":"2023-10-09T14:15:10.64Z","modified":"2026-06-17T06:07:08.75Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:08:36.656095Z"}],"osv":[{"id":"CVE-2023-36820","title":"micronaut security has invalid IdTokenClaimsValidator logic on aud","description":"Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.\n","status":"published","published":"2023-10-09T13:30:26.387Z","modified":"2026-10-28T10:35:17.491579142Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"GHSA-qw22-8w9r-864h","title":"io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud","description":"### Summary\n\nIdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider.\n\n### Details\n\nSee https://github.com/micronaut-projects/micronaut-security/blob/master/security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java#L202\n\nThis logic violates point 3 of https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation. \n\nWorkaround exists by setting `micronaut.security.token.jwt.claims-validators.audience` with valid values. \n `micronaut.security.token.jwt.claims-validators.openid-idtoken` can be kept as default on.\n\n### PoC\n\nShould probably be:\n\n```java\n                return issuer.equalsIgnoreCase(iss) \u0026\u0026\n                        audiences.contains(clientId) \u0026\u0026\n                                validateAzp(claims, clientId, audiences);\n```\n\n### Impact\n\nAny OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared.\n\n\n### Mitigation\n\nPlease upgrade to a patched `micronaut-security-oauth2` release as soon as possible.  \n\nIf you cannot upgrade, for example, if you are still using Micronaut Framework 2, you can patch your application by creating a replacement of `IdTokenClaimsValidatorReplacement`\n\n```java\npackage cve;\n\nimport io.micronaut.context.annotation.Replaces;\nimport io.micronaut.context.annotation.Requires;\nimport io.micronaut.core.annotation.NonNull;\nimport io.micronaut.core.util.StringUtils;\nimport io.micronaut.security.config.SecurityConfigurationProperties;\nimport io.micronaut.security.oauth2.client.IdTokenClaimsValidator;\nimport io.micronaut.security.oauth2.configuration.OauthClientConfiguration;\nimport io.micronaut.security.oauth2.configuration.OpenIdClientConfiguration;\nimport io.micronaut.security.token.jwt.generator.claims.JwtClaims;\nimport io.micronaut.security.token.jwt.validator.JwtClaimsValidatorConfigurationProperties;\n\nimport javax.inject.Singleton;\nimport java.net.URL;\nimport java.util.Collection;\nimport java.util.List;\nimport java.util.Optional;\n\n@Requires(property = SecurityConfigurationProperties.PREFIX + \".authentication\", value = \"idtoken\")\n@Requires(property = JwtClaimsValidatorConfigurationProperties.PREFIX + \".openid-idtoken\", notEquals = StringUtils.FALSE)\n@Singleton\n@Replaces(IdTokenClaimsValidator.class)\npublic class IdTokenClaimsValidatorReplacement extends IdTokenClaimsValidator {\n    public IdTokenClaimsValidatorReplacement(Collection\u003cOauthClientConfiguration\u003e oauthClientConfigurations) {\n        super(oauthClientConfigurations);\n    }\n\n    @Override\n    protected boolean validateIssuerAudienceAndAzp(@NonNull JwtClaims claims,\n                                                   @NonNull String iss,\n                                                   @NonNull List\u003cString\u003e audiences,\n                                                   @NonNull String clientId,\n                                                   @NonNull OpenIdClientConfiguration openIdClientConfiguration) {\n        if (openIdClientConfiguration.getIssuer().isPresent()) {\n            Optional\u003cURL\u003e issuerOptional = openIdClientConfiguration.getIssuer();\n            if (issuerOptional.isPresent()) {\n                String issuer = issuerOptional.get().toString();\n                return issuer.equalsIgnoreCase(iss) \u0026\u0026\n                        audiences.contains(clientId) \u0026\u0026\n                                validateAzp(claims, clientId, audiences);\n            }\n        }\n        return false;\n    }\n}\n``","status":"published","published":"2023-10-05T20:55:14Z","modified":"2026-09-10T03:49:25.100890923Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:55.122811Z"}]}}