← CVE Intelligence

CVE-2026-41164

nuts-node: JWT type confusion in v1 access token introspection allows VP replay as access token PUBLISHED

Description (CNA)

nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint (/auth/v1/introspect_access_token) accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims. This allows a Verifiable Presentation (VP) JWT to be replayed as an access token and receive an active: true introspection response. This vulnerability is fixed in 6.2.3 and 5.4.31.

Affected (CNA)

Vendor / productVersions
nuts-foundation / nuts-nodeaffected >= 6.0.0-alpha.1, < 6.2.3; affected < 5.4.31

CWE

CWE-345

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.