title: micronaut security has invalid IdTokenClaimsValidator logic on aud
description: Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.
problem types: CWE-284: Improper Access Control
affected:
{
vendor: micronaut-projects
product: micronaut-security
versions:
version: >= 3.11.0, < 3.11.1, status: affected
version: >= 3.10.0, < 3.10.2, status: affected
version: >= 3.9.0, < 3.9.6, status: affected
version: >= 3.8.0, < 3.8.4, status: affected
version: >= 3.7.0, < 3.7.4, status: affected
version: >= 3.6.0, < 3.6.6, status: affected
version: >= 3.5.0, < 3.5.3, status: affected
version: >= 3.4.0, < 3.4.3, status: affected
version: >= 3.3.0, < 3.3.2, status: affected
version: >= 3.2.0, < 3.2.4, status: affected
version: >= 3.1.0, < 3.1.2, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
]