micronaut security has invalid IdTokenClaimsValidator logic on aud

4.8 CVSS

Vulnerability Description

Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-36820

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from micronaut-projects

View All →

CVE-2024-23639

micronaut-core management endpoints vulnerable to drive-by localhost attack

Medium 5.1

CVE-2022-21700

Memory leak in micronaut-core

Medium 5.3

CVE-2021-32769

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in micronaut-core

High 7.5

Affected Vendor

micronaut-projects

View all reports →

Affected Software

micronaut-security

Vulnerable Versions:

>= 3.11.0, < 3.11.1, >= 3.10.0, < 3.10.2, >= 3.9.0, < 3.9.6, >= 3.8.0, < 3.8.4, >= 3.7.0, < 3.7.4, >= 3.6.0, < 3.6.6, >= 3.5.0, < 3.5.3, >= 3.4.0, < 3.4.3, >= 3.3.0, < 3.3.2, >= 3.2.0, < 3.2.4, >= 3.1.0, < 3.1.2