CVE-2026-114618: Jwt Aud Claim Validation Conditionally Skippedcve-2026-114618-jwt-aud-claim-validation-conditionally-skipped
JWT audience ('aud') claim validation is enforced only when the configured audience list is non-empty. When the list is empty the 'aud' claim options keep presence-only semantics, so a correctly signed assertion minted for another service (different audience) is accepted and can be exchanged for an access token across a trust boundary (RFC 7523 section 3). F
