CVE-2023-36820

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-36820
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36820.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-36820
Aliases
Published
2023-10-09T13:30:26.387Z
Modified
2025-12-04T23:58:02.303656Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
micronaut security has invalid IdTokenClaimsValidator logic on aud
Details

Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips aud claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.

Database specific 
{
    "cwe_ids": [
        "CWE-284"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36820.json"
}
References

Affected packages

Git / github.com/micronaut-projects/micronaut-security

Affected ranges

Type
GIT
Repo
https://github.com/micronaut-projects/micronaut-security
Events
Introduced
007d1bcabc8e6dfb2f5ae6f5f4f801302e22326e
Fixed
ddc0d2d9e3d812ce728e79b8a8628ab90d7fd2e8
Database specific 
{
    "versions": [
        {
            "introduced": "3.11.0"
        },
        {
            "fixed": "3.11.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/micronaut-projects/micronaut-security
Events
Introduced
4f67f8eea1cb7eaa5cffc8a1ff5c1fd76702734c
Fixed
462d77f6b958185487519a90e37674a78f3ee034
Database specific 
{
    "versions": [
        {
            "introduced": "3.10.0"
        },
        {
            "fixed": "3.10.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/micronaut-projects/micronaut-security
Events
Introduced
d6f78a62f013dc7c0b8340c84c57cb13bf7e2248
Fixed
453f810163e7a623f43a1d6be8cacc586c856472
Database specific 
{
    "versions": [
        {
            "introduced": "3.9.0"
        },
        {
            "fixed": "3.9.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/micronaut-projects/micronaut-security
Events
Introduced
bd036bd94b38d721e48bf30d0cb453d4799a75f9
Fixed
856156af444a69f852f35a98bf2167aa44e2bd99
Database specific 
{
    "versions": [
        {
            "introduced": "3.8.0"
        },
        {
            "fixed": "3.8.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/micronaut-projects/micronaut-security
Events
Introduced
44b4c260d26a25fc96f1aa7baf4bf0e0d6c44e89
Fixed
b7df87a4eed8d2a935345e2847180442f50a8fa6
Database specific 
{
    "versions": [
        {
            "introduced": "3.7.0"
        },
        {
            "fixed": "3.7.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/micronaut-projects/micronaut-security
Events
Introduced
2fb6b9be8521cbaac46c9065609af34fe489b6c9
Fixed
e5e7fc5b3ed4ac69bccb8676c9b67d6c9fdfa48b
Database specific 
{
    "versions": [
        {
            "introduced": "3.6.0"
        },
        {
            "fixed": "3.6.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/micronaut-projects/micronaut-security
Events
Introduced
2301f38015b598f788bf1d6f10fdec5edf3aa400
Fixed
e7c6f7e4618647049768cf9a9e4628b29eef6a6d
Database specific 
{
    "versions": [
        {
            "introduced": "3.5.0"
        },
        {
            "fixed": "3.5.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/micronaut-projects/micronaut-security
Events
Introduced
13a0ef86d18031e1b6cad426dff30759d2674da6
Fixed
da412c00d16c9007edc1a8a10a77228e0d47363b
Database specific 
{
    "versions": [
        {
            "introduced": "3.4.0"
        },
        {
            "fixed": "3.4.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/micronaut-projects/micronaut-security
Events
Introduced
cf77c7c5101dc19ff52cc13967e2aa56898bf60b
Fixed
df331d45cfe9d477208988aeaafb9b8b67078606
Database specific 
{
    "versions": [
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.3.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/micronaut-projects/micronaut-security
Events
Introduced
e67fe82d54f94d989a828226f3fd01150dc7f049
Fixed
783fe437ac373c8dc8206f04eb8716ace4544dac
Database specific 
{
    "versions": [
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.2.4"
        }
    ]
}
Type
GIT
Repo
https://github.com/micronaut-projects/micronaut-security
Events
Introduced
9d91f2162a221c135c4701d0114b183693034db3
Fixed
a517b7fd508de272608630e12f127d251dfea007
Database specific 
{
    "versions": [
        {
            "introduced": "3.1.0"
        },
        {
            "fixed": "3.1.2"
        }
    ]
}

Affected versions

v3.*

v3.1.0
v3.1.1
v3.1.2
v3.10.0
v3.10.1
v3.11.0
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v3.3.0
v3.3.1
v3.3.2
v3.4.0
v3.4.1
v3.4.3
v3.5.0
v3.5.1
v3.5.2
v3.5.3
v3.6.0
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.6.5
v3.6.6
v3.7.0
v3.7.1
v3.7.2
v3.7.3
v3.7.4
v3.8.0
v3.8.1
v3.8.2
v3.8.3
v3.8.4
v3.9.0
v3.9.1
v3.9.2
v3.9.3
v3.9.4
v3.9.5
v3.9.6