Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.micronaut.security:micronaut-security-oauth2

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5MavenPublished

    io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud

    CVE-2023-36820 · GHSA-qw22-8w9r-864h

    Affected
    • Maven io.micronaut.security:micronaut-security-oauth2 >= 3.11.0, < 3.11.1; >= 3.10.0, < 3.10.2; >= 3.9.0, < 3.9.6; >= 3.8.0, < 3.8.4; >= 3.7.0, < 3.7.4; >= 3.6.0, < 3.6.6; >= 3.5.0, < 3.5.3; >= 3.4.0, < 3.4.3; >= 3.3.0, < 3.3.2; >= 3.2.0, < 3.2.4; >= 3.1.0, < 3.1.2
    Fixed in
    3.2.43.10.23.5.33.1.23.9.63.8.43.3.23.7.43.6.63.11.13.4.3· Vendor fix available
    Issue
    IdTokenClaimsValidator skips aud claim validation if token is issued by same identity issuer/provider. Details See https://github.com/micronaut-projects/micronaut-security/blob/master/security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java#L202 This logic violates point 3 of https://openid.net/specs/openid-connect-core-10.html#IDTokenValidation. Workaround exists by setting micronaut.security.token.jwt.claims-validators.audience with valid values. micronaut.security.token.jwt.claims-validators.openid-idtoken can be kept as default on. PoC Should probably be: Impact Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. Mitigation Please upgrade to a patched micronaut-security-oauth2 release as soon as possible. If you cannot upgrade, for example, if you are still using Micronaut Framework 2, you can patch your application by creating a replacement of…

    Recommended action: Upgrade to 3.11.1, 3.10.2, 3.9.6 or 8 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →