CVE-2026-41164: nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token

May 5, 2026 (updated June 8, 2026)

The v1 access token introspection endpoint (/auth/v1/introspect_access_token) accepts any JWT signed by a key present on the node, without validating the JWT type, issuer-to-key binding, or required claims. This allows a Verifiable Presentation (VP) JWT to be replayed as an access token and receive an active: true introspection response.

References

github.com/advisories/GHSA-9hmg-827w-9rhj
github.com/nuts-foundation/nuts-node/releases/tag/v5.4.31
github.com/nuts-foundation/nuts-node/releases/tag/v6.2.3
github.com/nuts-foundation/nuts-node/security/advisories/GHSA-9hmg-827w-9rhj
nvd.nist.gov/vuln/detail/CVE-2026-41164

Code Behaviors & Features

Detect and mitigate CVE-2026-41164 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →