EUVD-2026-186651

fkie_cve-2023-36820

Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.

GHSA-qw22-8w9r-864h — io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud

Affected: Maven: io.micronaut.security:micronaut-security-oauth2

### Summary

IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider.

### Details

See https://github.com/micronaut-projects/micronaut-security/blob/master/security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java#L202

This logic violates point 3 of https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation.

Workaround exists by setting `micronaut.security.token.jwt.claims-validators.audience` with valid values. `micronaut.security.token.jwt.claims-validators.openid-idtoken` can be kept as default on.

### PoC

Should probably be:

```java return issuer.equalsIgnoreCase(iss) && audiences.contains(clientId) && validateAzp(claims, clientId, audiences); ```

### Impact

Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared.

### Mitigation

Please upgrade to a patched `micronaut-security-oauth2` release as soon as possible.

If you cannot upgrade, for example, if you are still using Micronaut Framework 2, you can patch your application by creating a replacement of `IdTokenClaimsValidatorReplacement`

```java package cve;

import io.micronaut.context.annotation.Replaces; import io.micronaut.context.annotation.Requires; import io.micronaut.core.annotation.NonNull; import io.micronaut.core.util.StringUtils; import io.micronaut.s…

Most recent entries from all

EUVD-2026-186651

fkie_cve-2023-36820

GHSA-qw22-8w9r-864h — io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud

gsd-2023-36820