PT-2026-60518 · Unknown · Jans-Auth-Server

CVE-2026-45795

·

Published

2026-07-16

·

Updated

2026-07-16

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions jans-auth-server versions prior to 2.0.0
Description The jans-auth-server accepts unsigned JWE (JSON Web Encryption) request objects. This occurs because the JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload() returns null. Additionally, the AuthzRequestService.processRequestObject() function does not reject the unrecognized RSA-OAEP algorithm when the forceSignedRequestObject variable is set to true.
Recommendations Update to version 2.0.0.

Exploit

Fix

Improper Verification of Cryptographic Signature

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-45795
GHSA-R3GJ-4PJ2-9J3J

Affected Products

Jans-Auth-Server