CVE-2023-36820

    Dashboard / Vulnerabilities / CVE-2023-36820

    CVE-2023-36820

    Published: 9 Oct 2023Last Modified: 12 Aug 2026

    Summary: micronaut security has invalid IdTokenClaimsValidator logic on aud

    Details: Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/provider. Any OIDC setup using Micronaut where multiple OIDC applications exists for the same issuer but token auth are not meant to be shared. This issue has been patched in versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36820.json, https://github.com/micronaut-projects/micronaut-security/security/advisories/GHSA-qw22-8w9r-864h, https://nvd.nist.gov/vuln/detail/CVE-2023-36820, https://github.com/micronaut-projects/micronaut-security/commit/9728b925221a0d87798ccf250657a3c214b7e980

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 007d1bcabc8e6dfb2f5ae6f5f4f801302e22326e
    Fixed -ddc0d2d9e3d812ce728e79b8a8628ab90d7fd2e8

    Affected versions

    3.11.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-36820 | CVE-DB