CVE Explorer
CVE-2026-41164
nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint (/auth/v1/introspect_access_token) accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims. This allows a Verifiable Presentation (VP) JWT to be replayed as an access token and receive an active: true introspection response. This vulnerability is fixed in 6.2.3 and 5.4.31.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"nuts-node","vendor":"nuts-foundation","versions":[{"status":"affected","version":">= 6.0.0-alpha.1, < 6.2.3"},{"status":"affected","version":"< 5.4.31"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:767b143785c72829702753c4e2ebf4eb92fb3c444b2d7b85de0ebd4fd835b2c3 · sha256:2f9298c80539f84c… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:767b143785c72829702753c4e2ebf4eb92fb3c444b2d7b85de0ebd4fd835b2c3 · sha256:2f9298c80539f84c… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-345","description":"CWE-345: Insufficient Verification of Data Authenticity","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:767b143785c72829702753c4e2ebf4eb92fb3c444b2d7b85de0ebd4fd835b2c3 · sha256:2f9298c80539f84c… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"name":"https://github.com/nuts-foundation/nuts-node/security/advisories/GHSA-9hmg-827w-9rhj","tags":["x_refsource_CONFIRM"],"url":"https://github.com/nuts-foundation/nuts-node/security/advisories/GHSA-9hmg-827w-9rhj"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:767b143785c72829702753c4e2ebf4eb92fb3c444b2d7b85de0ebd4fd835b2c3 · sha256:2f9298c80539f84c… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.