Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.4

nuts-node v1 access token introspection allows VP replay as access token

CVE-2026-41164 · published 5 months ago
Summary

The nuts-node v1 access token introspection endpoint does not properly verify access tokens, allowing a Verifiable Presentation (VP) JWT to be replayed as an access token and receive an active response. This is a risk because it could allow unauthorized access. To mitigate this, update to a version that includes the fix for this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
go github.com nuts-foundation <= 1.1.0
Original advisory text
nuts-node: JWT type confusion in v1 access token introspection allows VP replay as access token
nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint (/auth/v1/introspect_access_token) accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims. This allows a Verifiable Presentation (VP) JWT to be replayed as an access token and receive an active: true introspection response. This vulnerability is fixed in 6.2.3 and 5.4.31.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published26 May 2026
Updated26 Oct 2026
First seen5 May 2026
Sources
GHSA-9hmg-827w-9rhj · GHSA
CVE-2026-41164 · NVD
CVE-2026-41164 · OSV
Track software like this
Free during beta