CVE-2026-114618: Jwt Aud Claim Validation Conditionally Skipped
JWT audience ('aud') claim validation is enforced only when the configured audience list is non-empty. When the list is empty the 'aud' claim options keep presence-only semantics, so a correctly signed assertion minted for another service (different audience) is accepted and can be exchanged for an access token across a trust boundary (RFC 7523 section 3). F
Pythongreprules fetch cve-2026-114618-jwt-aud-claim-validation-conditionally-skipped --engine opengrepDescription
JWT audience ('aud') claim validation is enforced only when the configured audience list is non-empty. When the list is empty the 'aud' claim options keep presence-only semantics, so a correctly signed assertion minted for another service (different audience) is accepted and can be exchanged for an access token across a trust boundary (RFC 7523 section 3). F
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.