RFC 10070 – Closing the door on an actionable OAuth security vulnerability – Mike Jones: self-issued

In IETF, JSON, OAuth, OpenID, Security, Specifications
I’m pleased to announce that RFC 10070, which closes an actionable security vulnerability in OAuth 2.0 JWT Client Authentication, has been published. The abstract of the specification is:
This document updates RFCs 7521, 7522, 7523, and 9126 with respect to the treatment of audience values in OAuth 2.0 Client Assertion Authentication and Assertion-based Authorization Grants to address a security vulnerability identified in the previous requirements for those audience values in multiple OAuth 2.0 specifications.
As I described when writing about draft-ietf-oauth-rfc7523bis, which became this RFC, the security vulnerability was identified during formal analysis of an earlier draft of the OpenID Federation specification. The vulnerability resulted from ambiguities in the treatment of the audience values of tokens intended for the authorization server. The ambiguities enabled a malicious authorization server to use the token endpoint of a legitimate authorization server as the audience value, resulting in a client authentication JWT that the attacker could use there.
It’s interesting to note that the fix utilizes uses two features of OAuth 2.0 that did not exist when we wrote RFC 7523:
Both these newer features have become core components of how OAuth 2.0 is used in practice today.
The vulnerability was present in all of these OAuth 2.0 specifications, each of which were updated by this RFC:
Multiple OpenID specifications using JWT Client Authentication were also affected, including OpenID Connect Core, FAPI 2.0 Security Profile, OpenID Connect Client-Initiated Backchannel Authentication (CIBA) Core, and of course, OpenID Federation. All of these have since been updated or are in the process of being updated to address the security vulnerability in the same manner as is done by RFC 10070.
This specification was the result of thoughtful, careful, and timely action by those responsible for the affected specifications and ecosystems, including leaders in the OpenID Foundation, the IETF, and especially my co-authors Brian Campbell and Filip Skokan. Thanks to all who helped us achieve this important result!
You must be logged in to post a comment.
RFC 10070 – Closing the door on an actionable OAuth security vulnerability
OpenID Presentations at November 2026 OpenID Workshop and IIW
OpenID Connect Token Hash Algorithm Implementer’s Guide Published
Third Version of W3C Web Authentication (WebAuthn) is Now a Standard
JOSE and COSE HPKE specifications continuing to progress
Powered by WordPress & Theme by Anders Norén